The insurance fraud referral package was never the bottleneck: 51,419 reports in, 243 cases opened

New York's Insurance Frauds Bureau received 51,419 reports of suspected fraud in 2025 and opened 243 cases for investigation. Across the five years since 2020, reports received grew 70.8% while cases opened fell 25.0%. The supply of insurance fraud referral packages is compounding, and the capacity to act on them is shrinking. Which means the constraint on a fraud-suspected claim was never how fast the package gets assembled.

That matters this month because the referral package has just become a product category. On October 1, 2026, day three of ITC Vegas, Shift Technology introduced its Lead Package Agent, which takes an alert something else raised and assembles a referral-ready case package for an investigative team. It is well-scoped, genuinely useful work, and the democratisation argument behind it is correct. A six-person SIU at a regional carrier has never had the scheme knowledge or the data access a national carrier's unit has. An agent that closes that gap is worth buying.

The question a claims or SIU leader has to answer is a different one: what happens to the claim after the package exists. A referral documents suspicion. It does not take the coverage position, move the reserve, schedule the examination under oath, pay, deny, negotiate, defend the decision that follows, or recover a dollar. This post walks the whole path - what the package must legally contain, what Shift's agent does in Shift's own words, why more packages has not produced more cases, why filing one does not pause the statutory clock, and what the recovery numbers say about where the work actually ends. For the handler-assist side of Shift's catalogue, we covered Shift Claims against autonomous investigation separately.

New York is the conversion series to start with, because it reports both ends of the funnel for the same year. The Department of Financial Services files an annual report on the work of its Insurance Frauds Bureau, and the current edition, updated April 15, 2026 and submitted by Acting Superintendent Kaitlin Asrow under Section 409(b) of the Financial Services Law, states both numbers plainly: "In 2025, IFB received 51,419 reports of suspected fraud" and "In 2025, IFB opened 243 cases for investigation, affected 169 arrests, and referred 95 cases to prosecutorial agencies for prosecution." That edition does not publish a convictions count or a court-ordered restitution total for 2025, so neither appears here.

Run the division and the funnel is stark. 243 out of 51,419 is 0.47% of reports, about one in 212, that became a state investigation. 95 out of 51,419 is 0.18%, about one in 541, that reached a prosecutor. Both ratios are derived from the bureau's own figures, and both deserve the context the report supplies: "the vast majority" of reports "originated from licensees statutorily required to file reports of suspected insurance fraud with DFS", and approximately 1,400 of the total came from other sources, including non-profit organizations, businesses, consumers and anonymous tips. Approximately 72% of all suspected fraud reports, or 36,835, concerned no-fault automobile insurance, against 57 no-fault cases opened, about one in 646 and also derived. A referral is not a charge, and a bureau that opens 243 cases out of 51,419 reports is not failing at anything. It is behaving like an intelligence intake, which is what it is.

What has changed is the ratio between supply and capacity. In 2020 the bureau received 30,113 reports and opened 324 cases. In 2025 it received 51,419 and opened 243. Reports received grew 70.8%; cases opened fell 25.0%. Both derived, and from two editions: the 2025 figures from Appendix 1 of the current report, which runs 2021 to 2025, and the 2020 baseline from Appendix 1 of the prior edition. Every additional referral filed since 2020 has landed in a system whose throughput shrank by a quarter. That is the fact a referral-automation program runs into, and it is not a criticism of any vendor. It is arithmetic about the receiving end.

Drawn to a single scale, the 2025 funnel is hard to look at.

The lower three bars are almost invisible because they share a scale with the first one. California corroborates the shape in a second state and a single line of business. For fiscal year 2023-24 the Department of Insurance Fraud Division received 12,559 suspected fraudulent claims on automobile business and assigned 602 new cases, made 272 arrests and sent 354 cases to prosecuting authorities against $207,629,944 of potential loss. 602 out of 12,559 is 4.8% of suspected fraudulent claims that became an assigned case, and 354 out of 12,559 is 2.8% that reached a prosecutor. Both derived, both an order of magnitude above New York, and both far below the volume of the intake.

For an SIU director the practical reading is this. If a vendor is selling you more referrals, or better ones, the first number to put next to the proposal is what your last thousand referrals produced: how many the unit accepted, how many produced a documented finding, how many changed a payment, and how many returned a dollar. That is a different question from how fast a package can be assembled, and the answer is usually not in the file.

An insurance fraud referral package in a P&C claim is a regulated artefact, not a memo whose shape is up to the carrier. California's rules are the most prescriptive of any state, and the text is worth reading closely because it defines the trigger as well as the contents. Under 10 CCR 2698.30, a "reasonable belief" is "a level of belief that an act of insurance fraud may have or might be occurring for which there is an objective justification based on articulable fact(s) and rational inferences therefrom", and a Special Investigative Unit is "an insurer's unit or division that is established to investigate suspected insurance fraud".

Read that definition as a specification for an evidence file rather than as legal boilerplate. Objective justification based on articulable facts and rational inferences is exactly what a referral package has to carry, and it is why the regulation also prescribes the fields. 10 CCR 2698.37 and 2698.38 require the fraud type designation, the reporting party, the alleged victim, policy and claim specifics, loss amounts, a complete factual synopsis and identifiers for each party, including contact information, date of birth, social security number, driver's license and vehicle details where relevant. 10 CCR 2698.35 requires the carrier to establish, maintain, distribute and monitor written procedures for how integral anti-fraud personnel identify and refer suspected fraud, and 10 CCR 2698.36 requires the SIU's own written procedures to cover thorough file analysis, witness interviews, database use, evidence preservation and documented investigation summaries.

California: a 60-day deadline and a form with a name

The deadline is statutory, not regulatory. California Insurance Code 1872.4 requires an insurer that determines it has a reasonable belief of fraud to notify the Fraud Division "within 60 days after that determination by the insurer", and the report must carry "the information requested by the form and any additional information relative to the factual circumstances regarding the alleged insurance fraud and person or entity that may have committed or is committing insurance fraud, as specified in Section 2698.38 of Title 10 of the California Code of Regulations". The form has names an SIU will recognise: the Department's SIU Compliance Unit describes suspected fraud referrals as "known as eFD-1s, FD-1s, or SFCs", and says its office evaluates "the accuracy, completeness, and timeliness of the report filed by approximately 1,100 insurers each year".

Two other California provisions set the operating tempo around the referral. 10 CCR 2698.39 requires orientation for new employees within 90 days and annual in-service training for integral anti-fraud personnel. 10 CCR 2698.40 requires an SIU annual report within 90 days of the Department's notification, which goes out in June, covering SIU staffing, procedures, personnel qualifications, claims volume, referral statistics and civil fraud actions initiated. Referral statistics are a filed number, which matters before a program starts generating a lot more of them. We walk the whole regime in our guide to 10 CCR 2698 SIU compliance.

New York: a plan, a full-time unit, and a March 15 report

New York regulates the apparatus rather than the document. Insurance Law section 409 requires insurers writing at least 3,000 individual accident and health, workers' compensation or automobile policies annually in the state, or group policies covering at least 3,000 individuals, to file a Fraud Prevention Plan; HMOs with at least 60,000 enrollees file one too. The plan "must provide for a full-time Special Investigations Unit" and for six named elements: interface of SIU personnel with law enforcement and prosecutorial agencies; coordination with other units of the insurer for investigation and initiation of civil actions; development of a fraud detection and procedures manual; staffing levels and other resources based on objective criteria; in-service training of investigative, claims and underwriting personnel; and a public awareness program.

The Department's SIU guidance adds structural conditions that bear directly on who can own a referral package: the SIU must be a separate unit with its own budget line, investigative staff cannot perform claims or underwriting duties and vice versa, the unit should not report to claims or underwriting personnel except at executive levels, and the annual report on the plan is due no later than March 15 each year. A tool that compresses referral preparation sits inside that structure, not around it. The filings and the organisational constraints are in our breakdown of the New York Fraud Prevention Act SIU requirements.

The national picture: 42 states and the District of Columbia

Nationally, the National Association of Insurance Commissioners, on a topic page last updated June 23, 2026, records that "42 states and the District of Columbia operate insurance fraud bureaus that investigate claims of illegal insurance activities", and puts the consumer cost of insurance fraud at $308.6 billion a year, attributing the figure to the Coalition Against Insurance Fraud. The Coalition's own state index confirms named SIU requirements beyond California and New York: New Hampshire RSA 417:30, New Jersey 11:16-6.4 et seq., Kentucky KRS 304.47-080, Maine, and Florida s. 626.9891. A multi-state carrier is therefore running several referral regimes at once, with different triggers and different deadlines, against the same claim file.

Take the product on its own terms, because the terms are accurate and the scope statement is explicit. Shift writes that the agent "turns a single alert into an expert-ready package in hours instead of weeks", that "what used to take weeks of manual research now comes together in hours", and that "every finding traces back to its source, so the investigator stays fully in control of the decision and the agent simply does the assembling". The stated inputs are "claims data, public records, credentialing checks, and adverse media". The stated start is an alert. The stated end is a referral-ready case package delivered to an investigative team for decision-making.

Concede the democratisation point plainly, because it is the part of that page that matters most to a small unit. Shift writes that with the agent, "no team is left without the fraud scheme knowledge or data access that only the best-resourced SIUs have historically had". That is true, and it is among the most valuable things an agent can do for a six-person SIU. Scheme knowledge has always been distributed unevenly across the industry, and the units that need it most are the ones with the fewest investigators to carry it. An agent that puts credentialing checks and adverse-media scanning in front of a small unit changes what that unit can see.

Record what Shift did not claim on that page, because vendor pages usually claim more. There is no claim of autonomy. There is no claim to resolve or close a claim. There is no number attached to "hours", which is the claim that would be hardest to defend. There is no invocation of autonomy levels or maturity tiers. The page is a scope statement, and a disciplined one.

Three of the claims on that page used to separate vendors and no longer do. Weeks of research compressed into a fraction of the time, per-finding traceability back to a source document, and the human keeping the decision are now table stakes in this category rather than differentiators. That is useful information for a buyer: if two vendors both say all three, those three sentences cannot decide the evaluation, and the evaluation has to move to scope. Our 2026 buyer's guide to AI fraud platforms sorts the category on that basis.

Shift is also not a single-agent company, and any argument that treats it as one is wrong. Its Solutions navigation describes agent lines across most of the claim. Reproducing its own descriptions is the fairest way to show the surface.

So this is not an argument that Shift has nothing downstream of the referral. It plainly does, including a Subrogation agent that creates an initial demand package. The argument is about one agent's scope and about platform architecture, and the clearest statement of that scope is Shift's own. Writing about a social adult day care payment-integrity example on a companion page dated October 6, 2026, Shift says: "That transparency keeps the investigator in charge of the decision: the agent handles the assembly, and a senior reviewer still decides what gets referred and how it moves forward." That worked example is a health plan use case rather than US P&C, and the sentence is a scope statement rather than a caveat. The agent's job ends at the decision about what gets referred. Everything after that decision is the rest of this post.

Between the package and the case sits an acceptance gate, and the benchmarking data on it is rarely quoted. The 2024 Insurer SIU Benchmarking Study, run by Aon's Strategy and Technology Benchmarking group with the Coalition Against Insurance Fraud across 35 participating P&C carriers, reports that automated SIU investigative referrals rose by 6 percentage points to 45% of all referrals to SIU, with adjuster referrals dropping to 49%. Then it reports the acceptance side: of accepted referrals, adjusters account for 60%, automated fraud detection tools 29%, and all other sources 10%. The automated share of accepted referrals is up from 21% in the 2022 study, so the trend is real and it is moving in the right direction.

The acceptance ratios are what make the gap legible. The study puts adjuster referral acceptance at 70%, down from 76% in 2022, and the automated-tool acceptance ratio at 36%, up four percentage points from 32%. Multiply the shares by the ratios and the study's own numbers reconcile: 45% of referral volume at a 36% acceptance ratio contributes 16.2% of all referrals as automated and accepted, while 49% at 70% contributes 34.3%. The ratio between those two, 0.47, lands almost exactly on the reported 29 against 60 split of accepted referrals, which is 0.48. Automated referrals are accepted at roughly half the adjuster rate, derived two independent ways from one study.

The honest reading of that gap is not that automated referrals are worse. It is that a flag and a case are different objects, and the unit decides which flags become cases on a fixed budget of investigator attention. The same study measures that budget. Annual accepted referrals per investigator rose to 174 from 162 in 2022. Monthly referrals per investigator run 11.6 for field investigators and 17.9 for desk investigators, with desk investigators now carrying 47% of accepted referrals, up from 44% in 2022 and 42% in 2019. Anti-fraud headcount grew 0.5% between 2023 and 2024, down from 1.4% growth in the previous study. SIU budgets sit at about 0.12% of overall premium, down from 0.13%, and carriers averaged 0.67 FTE per $100 million of gross premiums written against 0.9 two years earlier.

Put those together and the receiving end of a referral-automation program is a unit whose staffing per premium dollar has fallen by roughly a quarter in two years while its intake grows. Practitioners have said as much for years, and the quotes read better in the order they were given.

The pro-automation counterargument from the same article is the fair one, and it comes from a detection vendor. Dan Gumpright, vice president of global products at FRISS, told Insurance Journal in August 2020 that acceptance improves with use: "As people deploy these, you start accepting a lot more of the referrals and then you learn what you need to accept over time." He also conceded the trade directly: "I think in general they are going to have a slightly lower acceptance rate but the fraud they are finding will be significant." Brad Barron, a fraud and financial crimes consultant at SAS quoted in the same piece, put the measurement problem in one line: "So it's not just the quantity of referrals, but also the quality that matters." Six years on, the Aon data says the acceptance ratio did improve, from 32% to 36%, and that it is still half the adjuster rate.

One more historical data point deserves a precise date. Shift itself observed in an August 2022 perspective piece that "in 2017, 22% of fraud cases were referred from automated systems - but in 2019, that number was just 15%". Automated referral share has since recovered and passed both figures. The direction is not in dispute. What the data does dispute is the assumption that referral volume and referral quality translate into cases, findings and dollars without something changing at the receiving end. That is the same bottleneck we measured in why most flagged insurance claims are never fully investigated.

One clarification on numbers, because two different metrics get conflated here. Aon's 174 is accepted referrals per investigator per year. Hesper's internal benchmark of 200+ cases per investigator is open caseload, not accepted referrals, and manual investigation running 14+ days per case is also a Hesper internal benchmark. The two measures are not the same quantity and should not be divided into each other. What the Aon figure does corroborate is the order of magnitude: an investigator's year is measured in low hundreds of files, whichever way you count them.

This is the whole argument in one statute. Florida Statute 627.70131 requires an insurer to "within 7 calendar days, review and acknowledge receipt of such communication" from a policyholder, and provides that "within 7 days after an insurer receives proof-of-loss statements, the insurer shall begin such investigation as is reasonably necessary". Subsection (7)(a) is the one that matters here: "Within 60 days after an insurer receives notice of an initial, reopened, or supplemental property insurance claim from a policyholder, the insurer shall pay or deny such claim or a portion of the claim unless the failure to pay is caused by factors beyond the control of the insurer."

Now line that up against the referral deadline. California gives the carrier 60 days from its own determination of reasonable belief to notify the Fraud Division. Florida gives the carrier 60 days from notice of the claim to pay or deny it. Those two clocks start at different events and run at the same time. The referral clock starts when suspicion crystallises, which is usually well after first notice. The disposition clock started at first notice. Filing the referral consumes time on the second clock and buys none.

That is why compressing referral preparation and compressing the claim are different purchases. An SIU that gets its package assembled sooner has more days to interview, to pull records and to run an examination under oath before the file has to be resolved. An adjuster whose coverage decision is due in 60 days gains nothing from a faster referral unless the same evidence pass also produces the coverage position, the reserve note and the documented reasoning behind them. We treated the reporting-deadline side of this in how AI agents compress SIU reporting timelines.

The destination of an SIU investigation is a decision about payment, and the person who ran the Coalition Against Insurance Fraud put it more precisely than any vendor page has.

Payment of the claim. Not referral of the claim. Everything between the package and that decision is work somebody has to do, and it is worth itemising, because the itemisation is what a scope conversation needs. The coverage position requires reading the policy and every endorsement against the facts as found, then producing a cited position that will survive a complaint. The reserve has to move, which means a damages estimate defensible to an actuary. An examination under oath has to be scheduled, conducted, transcribed and then read against the rest of the file. We are not attaching a number to how long one takes, because no primary source we trust publishes one, but nobody who has sat through one thinks it is quick. The disposition decision then has to be taken, documented and, if challenged, defended.

The industry has a price for the investigation step alone. The Aon and Coalition study puts the budget expense per investigation at just above $1,200, up about 11% from the 2022 study, with national carriers running roughly 50% below regional carriers on that measure. Average SIU salary came in just under $96,000 against $89,000 in 2022. Field and desk investigators together are roughly three quarters of SIU headcount, and the study records attorneys at 0% of SIU employee distribution, which says something about where the legal work on a contested fraud denial actually happens: not in the unit that produced the referral.

Precision in that downstream work is not an aesthetic preference. Smith, again, on the failure mode that matters most to anyone who has to defend a file.

He also makes a vocabulary point an SIU director will recognise and a vendor rarely gets right: "When evidence of insurance fraud is found, though, a claim is never 'denied.' You cannot deny something which they were never entitled to because of their own deliberate acts." The distinction matters because the artefact that supports a rescission, a recoupment or a declination is not the referral package. It is a complete file: the policy language, the material misrepresentation, the payment ledger, the evidence of the deliberate act, and the documented reasoning that connects them. That file is what our fraud investigation module is built to produce, and it is also the thing a manual unit spends most of its 14+ days per case assembling, a Hesper internal benchmark that also frames the comparison against manual investigation.

The pair of numbers that settles this sits in the same New York report, same year, same population of insurers. In their electronically filed Annual SIU Reports, insurers reported "approximately $3.5 billion in savings and approximately $40.3 million in recoveries from SIU investigations in 2024 (the most recent year for which data is available)". Derived, recoveries were 1.2% of claimed savings. Those are not competing estimates from different studies. They are two lines in the same filings.

The criminal track makes the same point at a smaller scale. New York's 51,419 reports in 2025 produced 169 arrests and 95 cases referred to prosecutorial agencies, and the current report publishes no convictions count and no court-ordered restitution total to put beside them. California does publish both. Its District Attorneys' Automobile Insurance Fraud Program, funded at $16,265,714 across 34 counties in fiscal 2023-24, prosecuted 1,036 cases involving 1,111 defendants, obtained 343 convictions and had $1,772,027 of restitution ordered. That is roughly $5,166 per conviction, derived, and ordered is not the same as collected. Restitution is the criminal system's recovery mechanism, and it is small by construction. It was never built to make a carrier whole.

Civil recovery is where the money is, and it needs a different package. A subrogation claim against a third party, a salvage realisation, a fraud-based rescission or a recoupment action all require liability facts, the policy language that creates the right, the payment ledger showing what was actually paid, proof of damages, and a demand a defending adjuster or arbitrator will accept. The referral package proves suspicion. The recovery package proves entitlement. Nothing in a lead package produces the second one, and the industry's recovery numbers show how rarely anyone builds it: one in four US property-liability insurers records no salvage or subrogation recovery at all in a given year. That is why every file gets screened for subrogation and salvage rather than the ones somebody remembered to look at.

Laid out stage by stage, the question stops being which vendor is better and becomes how many handoffs a carrier is willing to own. The table below maps the stages of a fraud-suspected claim to categories of tool rather than to feature checkboxes, and each cell says what that category's public materials describe. Where a cell reads "outside the stated scope", that is a statement about one named product's published scope, not a capability judgement about a company.

Three footnotes keep that table honest. First, the Shift column is the Lead Package Agent specifically, not Shift Technology: as the solutions table above shows, Shift sells Coverage & Liability, Subrogation, Injury and Process agent lines plus the Insurance Data Network, and its Subrogation agent explicitly creates an initial demand package. Second, "outside the stated scope" is read off public product descriptions, and it is the correct standard to hold any vendor to, including us. Third, the detection column covers three different companies whose materials describe scoring and flagging at and after first notice: FRISS, Verisk's ISO ClaimSearch as a contributory data utility with scoring on top, and Shift's own Fraud & Risk line.

Two categories sit outside the table and belong in the picture. Owl.co runs an evidence layer on top of the claims system: its products read the file and answer with citations, and monitor eligibility through public records, court filings and social posts, with SIU, subrogation, legal and medical review among its listed use cases and an explicit policy that its AI never denies a claim. Its named production customers are mostly life and disability rather than US P&C. CCC Intelligent Solutions pairs auto fraud screening built to prioritize work for investigators with dedicated inbound and outbound AI subrogation, including demand generation and evidence packaging. Both are better described as layers than as stages, which is the useful way to read this market: some vendors own a stage, some own a layer across stages, and the carrier assembles the rest.

State the architectural difference plainly, because it is the part a competitor could not restate about itself. On a suspicious claim, the facts that justify the referral are the same facts that decide the coverage position, set the reserve, price the settlement and support the recovery demand: the date and time of loss, the policy and its endorsements, the statements and their inconsistencies, the treating providers and their other files, the prior-loss history, the payment ledger. A platform that runs one investigation-grade evidence pass and then serves all six decisions out of that single sourced, timestamped record is built differently from a set of per-decision products, each of which re-reads the file to produce its own output. On that architecture the referral package is one export of the evidence file rather than the product itself.

That is the claim Hesper is built on, and the supporting figures are internal benchmarks that we label as such. Manual investigation runs 14+ days per case and one investigator carries 200+ cases, which is why about 25% of flagged claims get a real workup and the rest are triaged away by arithmetic rather than by judgement. Running 15+ investigation phases in parallel takes a case to minutes, not weeks, at a fraction of the manual cost, and moves coverage of flagged claims from about 25% to 100%. The point of the coverage number is not throughput for its own sake. It is that the acceptance gate in the Aon data exists because attention is scarce, and a unit that can work up every flag makes the accept-or-decline call on evidence rather than on capacity.

Every claim, first notice to final recovery, with evidence behind every decision. Clean claims resolve straight through; suspicious claims get an investigation-grade workup. In fraud terms that is the move from fraud detection to fraud resolution: the agents assemble, the investigator decides what gets referred and how it moves forward, and the same file then carries the coverage decision, the reserve, the disposition and the recovery screen without being rebuilt three more times. Fraud detection is built in, so Hesper runs standalone, and it is complementary where a carrier already runs FRISS, Shift or Verisk, with their flags coming in and the investigation running on top. The head-to-head view is at Hesper against Shift Technology.

For an SIU director the practical test of that architecture is not speed. It is whether every finding in the file traces to a source document with a page, a line or a timestamp, whether an investigator can override any conclusion and have the override logged with its reasoning, and whether the same record can be produced for a state DOI examination, a deposition, an examination under oath or a capacity partner's claims audit without being reassembled by hand. That is the standard an SIU gets held to. It should be the standard a vendor gets held to as well.

None of these questions is a trap, and a well-scoped product should answer all of them without difficulty. They are the questions that turn a demo about assembly speed into an evaluation about the whole claim, and they are worth asking of every vendor in the category, this one included.

1. Where does this agent's scope end, in your own words, and which of our downstream decisions does it not touch? Compare the answer to the public product page, because the page is what we will be held to.
2. When the SIU accepts the referral, what does the next person open: a package, or the same working file with the referral as one export of it?
3. Does the coverage position draw on the same sourced record as the fraud finding, or does somebody read the policy again from the beginning?
4. What happens to the pay-or-deny clock while the referral is being prepared? Show the two timelines side by side on a real file shape.
5. Who screens this file for subrogation and salvage, at what point, and against what evidence? A fraud finding on its own has never returned a dollar.
6. If a state DOI examiner, a deposing attorney or a capacity partner's auditor asks why a decision was taken, what gets handed over, and how much of it has to be rebuilt by hand?

The referral package is a real artefact with prescribed contents, a statutory deadline and a named form, and automating it well is a real contribution to a unit that has never had the data access a national carrier's SIU takes for granted. It is also, on the industry's own primary data, the point at which all but about one New York report in 212 stops being anything at all. Buy the assembly. Then ask what happens on day two.