The State of Insurance Fraud Detection in 2026

The Coalition Against Insurance Fraud estimates that fraud costs the US about $308.6 billion a year across all lines of insurance (2022 study). The industry's response has been substantial: most large carriers run a detection platform (FRISS, Shift Technology, Verisk, or internal rules engines) and maintain a Special Investigations Unit. Yet by Hesper AI's benchmark, roughly 75% of the claims those systems flag as suspicious are never fully investigated.

The shortfall is not about intent or resourcing in the conventional sense. Carriers are not underfunding SIU. The problem is architectural: rules-based detection generates alerts faster than manual investigation can work them - roughly four to one, on Hesper AI's benchmark. The result is a structural backlog that grows every quarter.

This report documents what autonomous AI investigation agents are changing about that equation - how they shift throughput from ~10 investigations per investigator per month to 800+, how they close the coverage gap from 25% to 100% of flagged claims, and what the new buyer evaluation framework looks like for enterprise carriers selecting technology in this category.

Key findings are summarized below. The full analysis, with sources and operating benchmarks by carrier size, follows in Parts 1 through 7. Public figures are attributed to their primary sources; figures marked as Hesper AI benchmarks are Hesper's own working estimates.

Insurance fraud is a large category that is becoming less stable. The headline number - about $308.6 billion a year across all lines, per the Coalition Against Insurance Fraud's 2022 study - is a modelled estimate, not a count of detected fraud: for most lines it applies an assumed fraud rate to that line's losses, spending or premiums. That makes it useful for scale and weak for precision. AI-generated documents add pressure the estimate was not built to capture.

Estimated cost by line of business

Fraud is not spread evenly across lines. In the CAIF breakdown, life insurance ($74.7B) and Medicare and Medicaid ($68.7B) are the largest lines. Property and casualty fraud is $45B, a figure that excludes workers' compensation and auto theft, which CAIF counts separately. Workers' compensation is $34B, of which $25B is premium fraud rather than claim fraud, and premium avoidance ($35.1B) is likewise fraud at underwriting, not at the claim.

Source: Coalition Against Insurance Fraud, The Impact of Insurance Fraud on the U.S. Economy (2022), prepared by the Colorado State University Global White Collar Crime Task Force. All values are modelled estimates, not measured losses. The P&C figure is 2020 P&C incurred losses and LAE ($450.8B) multiplied by an assumed 10% fraud share. Workers' compensation is $9B claimant fraud plus $25B premium fraud. Premium avoidance averages a CPI-adjusted Verisk 2017 auto premium-leakage estimate ($29B, which measures fraud at underwriting, not claims fraud) with a figure derived from a 2017 RGA survey. The total includes auto theft, which CAIF itself notes is not insurance fraud unless the insured is involved.

Where the "10% of P&C is fraud" figure comes from

The most repeated number in P&C fraud traces to the Insurance Information Institute. In the late 1980s the III interviewed claims adjusters and concluded that fraud accounted for about 10% of the property/casualty industry's incurred losses and loss adjustment expenses each year. CAIF's 2022 study quotes that estimate, adopts 10% as its P&C multiplier, and notes that the III did not specify how it derived the figure. Two things follow: it is a share of losses and LAE, not a share of claims, and it is more than 35 years old.

The one line-specific measurement CAIF cites is narrower. The Insurance Research Council's 2015 study estimated that fraud and buildup accounted for 15-17% of total claim payments for auto insurance bodily injury in 2012, or $5.6B-$7.7B. Two other figures often credited to the FBI - more than $40 billion a year in non-health insurance fraud, and $400-$700 a year per family in higher premiums - come from an undated FBI web page, since removed from fbi.gov, that named no study or methodology; CAIF's own reference list cites it as "n.d." They are not a current FBI estimate, and this report does not rely on either.

The AI-generated fraud surge

The fastest-growing threat in claim fraud is AI-generated: synthetic documents, deepfake images, fabricated medical records produced with commodity generative AI tools. Hard numbers for US insurance claims are scarce. The most-cited adjacent figure comes from Signicat's February 2025 report The Battle Against AI-Driven Identity Fraud: Signicat says deepfakes now make up about 6.5% (1 in 15) of the fraud attempts it detects, an increase it puts at 2,137% over three years. That figure comes from Signicat's own identity-verification detection data, not from the report's survey of 1,206 fraud decision-makers at European banks, insurers, payment providers and fintechs. It is not an insurance-claims measurement, but it shows the direction. Generative tools that previously required a graphic designer to produce a convincing fake document now require a smartphone and a reference template.

This shift has two consequences for carriers. First, the detection tools built around the prior threat model - OCR validation, rule-based signatures, manual visual inspection - miss the new failure mode. Second, the volume of fake-document production has outpaced the capacity of traditional forensic review, making document-level pixel forensics a floor requirement rather than a specialty capability.

The detected vs. uncaptured gap

Detected fraud is a fraction of total fraud, but no published study measures how large a fraction; the CAIF figures above are modelled, not counted. In practice, most carriers know their detection rate is lower than they would like but are constrained by investigation capacity - detection without follow-through is an accounting entry, not a recovery.

For the purposes of this report, the uncaptured portion is not the interesting question. The interesting question is: of the claims that are flagged as suspicious, how many actually receive investigation? That is the coverage gap that Part 3 quantifies.

Rules-based fraud detection platforms are effective at what they were designed to do - surface suspicious claims at scale. They are not effective at what the industry implicitly expects them to do - resolve cases. Understanding the architectural difference between detection and investigation is the prerequisite for every technology decision in this category.

How rules-based detection works

A fraud scoring platform ingests a claim and evaluates it against a library of red-flag rules - late reporting, high loss amount, recent policy inception, prior claim history, network overlap with known fraudsters, provider pattern matches. Each rule contributes a weighted signal. Signals are combined into a risk score, typically on a 0-100 scale. Claims above a configured threshold generate alerts that route to the SIU queue.

This pipeline is fast, interpretable, auditable, and regulator-friendly. It is also the only architecture most carriers have for fraud detection at scale. FRISS, Shift Technology and Verisk combine rules, machine-learning models and network analysis in different proportions, and ISO ClaimSearch supplies the cross-carrier claim matching many of them draw on. The output is the same kind of thing: a score and an alert for a person to work.

The structural false positive rate

The consequence of rules-based design is a high false positive rate. A detection platform evaluating ~30 signals per claim cannot reliably distinguish "unusual" from "fraudulent." Many legitimate claims share characteristics with fraudulent ones - late reporting, high loss amount, recent policy inception, prior claims history. The signals are correlated with fraud but not diagnostic of it.

In Hesper's conversations with SIU teams - not a published survey - confirmation rates on referred cases run 15-40%, meaning 60-85% of alerts do not result in confirmed fraud when fully investigated. This is not a defect in any specific vendor's product. It is a ceiling imposed by the category: signal density is limited, the scoring model optimizes for recall, and the distinguishing evidence lives in documents, statements, and public records that the detection platform does not examine.

The detection system is designed to find every suspicious claim. The SIU is designed to investigate some of them. The gap between those two designs is the capacity crisis.

Signal density comparison

Signal counts are Hesper AI estimates, not vendor-published figures. The signal-density delta (6-7x) is the mechanical difference between "finding suspicious claims" and "investigating them." Autonomous investigation adds document forensics, medical record analysis, OSINT, statement cross-referencing, and timeline reconstruction to the baseline detection signal set.

Most US states require insurers to maintain a Special Investigations Unit or a filed anti-fraud plan, and large carriers run SIUs regardless. Yet the aggregate capacity of these units is structurally unable to keep pace with the detection systems that feed them. The numbers below are Hesper AI benchmarks - working estimates, not published industry statistics - and the imbalance they describe holds across carrier tiers.

The per-investigator math

The coverage gap

Apply these numbers to a mid-size regional carrier: 10 SIU investigators, 400 flagged claims per month. Manual capacity is 10 investigators × ~10 investigations/month = 100 investigations, the ~25% benchmark. The remaining 300 flagged claims per month (~75% of detection volume) receive abbreviated review or none. Annualized: ~3,600 flagged claims per year that the detection system surfaced but the investigation workflow could not absorb.

Top-20 carriers face the same ratio at larger absolute scale. A carrier generating 100,000 referrals a year fully investigates about 25,000 of them at the ~25% benchmark, and even that quarter takes roughly 200 investigators at ~10 closes a month each. Covering the other ~75,000 the same way would take about 600 more.

Why more investigators doesn't scale

The obvious response to a capacity gap is more investigators. Three factors make this difficult. First, qualified SIU investigators are a constrained labor market with meaningful training and certification barriers. Second, the fully loaded cost of an SIU hire ($100-200K annually, by Hesper estimate) scales poorly against the value per investigation. Third, investigator productivity is rate-limited by the workflow, not by hours-in-the-day. An investigator working 200 active cases is constrained by context-switching and evidence-gathering latency, not calendar hours.

This is why the capacity constraint has been stable for a decade despite persistent carrier efforts to expand SIU. The workflow imposes a per-investigator throughput ceiling that adding headcount cannot meaningfully raise.

Autonomous AI investigation agents address the workflow ceiling directly. Rather than adding another layer of scoring or an additional alert source to the SIU queue, they automate the evidence-gathering, analysis, and report-generation stages of the investigation itself. By the Hesper estimate in Part 3, evidence gathering and report writing alone take about 60% of an SIU investigator's time, and much of the ~28% spent on administration and coordination goes with them.

Architecture: 15+ investigation phases in parallel

A properly designed autonomous investigation agent decomposes a claim into 15 or more investigation phases and runs them concurrently against the relevant data sources. For a flagged auto injury claim, this includes:

• Document forensics - pixel-level analysis of claim documents, medical records, repair estimates, and photographs
• Medical record analysis - reviewing treatment against injury mechanism, flagging inconsistencies, identifying upcoding patterns
• Database cross-referencing - NICB, ISO ClaimSearch, state DMV, NMVTIS, prior claims history
• Public records and OSINT - court records, social media, business filings, property records
• Statement analysis - recorded statements and EUOs cross-referenced against submitted documentation
• Financial analysis - loss calculation, billing pattern analysis, motive indicators
• Timeline reconstruction - chronological narrative from all sources
• Network analysis - relationships between claimants, providers, attorneys, and known fraud rings
• Report generation - structured investigation report with citations and confidence scores

The output is not a risk score or an alert. The output is an investigation-ready report that an SIU investigator can review, adjust, and sign off on. The investigator's role shifts from performing the investigation to reviewing the findings - from execution to decision-making.

What stays human

Three parts of the workflow remain with human investigators: the fraud determination and the claim decision, the referral of suspected fraud to the state fraud bureau (plus any SAR filing on covered life and annuity products), and testimony in any contested claim denial or criminal prosecution. AI investigation agents produce the evidence package and the recommendation; the investigator decides and represents.

This is a regulatory and operational feature, not a technical limit. State unfair claims settlement practices laws, most modelled on the NAIC model act, prohibit refusing to pay a claim without a reasonable investigation, and the NAIC's December 2023 Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted by more than 20 states, holds insurers accountable for decisions made with AI. A vendor pitching fully autonomous fraud denials is asking the carrier to carry that exposure.

Before and after, stage by stage

Manual durations are Hesper AI estimates of a typical manual SIU workflow.

The 2020-2025 SIU benchmarks were stable because the underlying workflow was stable. Autonomous AI investigation fundamentally changes the workflow, which means the benchmarks change. SIU leaders rebuilding capacity plans for 2026 and beyond need new numbers.

All figures in this table are Hesper AI benchmarks and illustrative estimates, not published industry data. The confirmed-fraud row applies the 15-40% confirmation rate SIU teams report to us to both coverage levels; manual queues that work the highest-scored referrals first will confirm at the top of that range.

The throughput and cost changes are the headline. The confirmed-fraud-rate change is more subtle: AI investigation does not make detection more precise, but it removes the capacity ceiling that previously limited investigation coverage. Cases that were closed without investigation under manual workflows now receive investigation, and a meaningful minority of those turn out to involve actual fraud. The base of confirmed fraud widens as a direct consequence of closing the coverage gap.

Benchmarks by carrier size

Illustrative. Manual capacity applies the ~25% coverage benchmark to each flagged-volume range. Absolute numbers scale with carrier size; ratios are stable. Smaller carriers face a disproportionately steep economic hurdle to manual SIU expansion, which is why the AI-augmented benchmark has outsized impact at the mid-market and specialty lines.

The economic case for autonomous AI investigation is driven by three compounding effects: direct cost reduction per investigation, claim leakage recovery from closing the coverage gap, and the downstream effect of rising detection precision as completed investigations feed back into rule tuning.

Direct cost savings

Per-investigation cost falls once the work runs autonomously instead of on investigator hours. The expensive half of that comparison is the half already sitting on the books, so size the opportunity from there. For a larger regional carrier processing 2,000 flagged claims per month:

• Manual investigation at 25% coverage: 500 fully loaded investigations a month, already a material line on the budget
• Full coverage at the same manual unit cost: 2,000 investigations a month, four times that bill, which is why coverage gets rationed instead of expanded
• The case for autonomous investigation is the gap between those two lines: full coverage stops being a staffing question

Claim leakage recovery

The larger economic effect is claim leakage recovery from closing the coverage gap. Flagged claims that close without investigation under manual workflows include a meaningful fraction of actual fraud. There is no agreed industry standard for measuring claims leakage, so the inputs below are Hesper's illustrative assumptions, not published estimates: 15-20% of uninvestigated flagged claims involve actual fraud, with average claim inflation of 20-40% of claim value. For published leakage figures and how they are measured, see State of Claims Automation 2026.

Apply to the same carrier: 1,500 uninvestigated flagged claims per month × $8,000 average claim value × 17.5% fraud rate × 30% average inflation = ~$630K per month in leakage = ~$7.6M annual. That leakage, sitting in the queue nobody works, is the number to weigh any investigation spend against.

Evaluation frameworks from the rules-based detection era do not transfer cleanly to autonomous investigation. Procurement teams need a new set of criteria. The framework below is organized around four categories: technical, operational, compliance, and economic.

Technical criteria

1. Scope and output type. Ask what the system produces: a risk score or an investigation-ready report. Risk score = detection. Cited report with findings and recommendation = investigation. These are different categories.
2. Signal density per case. Rules-based detection evaluates ~30 signals. Autonomous investigation should evaluate 200+. Ask for the full list of data sources and signals per case type.
3. Evidence and citations. Every finding in the report should trace to a specific document, statement, database query, or public record. Black-box scoring without citations is a red flag - not because the underlying model is wrong, but because carriers cannot defend claim denials on unverifiable output.
4. Integration path. The system should sit downstream of the existing detection stack (FRISS, Shift, Verisk, ISO ClaimSearch) via standard APIs, not require replacement. Integration timelines of 30-90 days are achievable with modern agents; 6-18 months suggests legacy-style deployments.

Operational criteria

5. Investigation coverage commitment. The headline metric. Target: 95-100% of flagged claims receive full investigation within minutes of flagging.
6. Throughput per investigator. Target: 800+ cases per investigator per month in a review-oriented role.
7. Deployment timeline. 30-90 days is the modern standard. Ask for reference deployments with specific milestone schedules.
8. Report quality and format. Audit-ready output means structured sections, full citations, timeline reconstruction, and a denial/payment recommendation - not a data dump for the investigator to rewrite.

Compliance criteria

9. Data retention and privacy. Retention windows must be customer-controlled, documented, and auditable. PHI and PII handling must be documented and auditable. SOC 2 attestation (or documented pursuit) is a minimum.
10. Regulatory posture. Carriers remain accountable for claim decisions under state unfair claims settlement practices laws and, in states that have adopted it, the NAIC's 2023 Model Bulletin on the Use of AI Systems by Insurers. A workflow that denies claims autonomously puts that accountability at risk; the fraud determination should stay with a named human.
11. Audit trail. If a regulator or litigant requests the investigation record, the carrier must be able to produce the full chain - signals evaluated, sources queried, findings surfaced, decisions made.

Economic criterion

12. Measurement. Detection metrics (precision, recall, alert volume) do not measure investigation value. Investigation metrics: confirmed fraud per flagged case, investigation coverage rate, average time-to-close, claim leakage reduction, recovery rate, fraud referral accuracy.

Red flags in vendor claims

• "AI-powered" without a clear answer to "what does it do?" → probably detection in a new wrapper
• Unwillingness to show a sample investigation report on a similar claim
• "Replaces your SIU team" claims → hard to square with carrier accountability for claim decisions
• Deployment timelines of 6+ months for what should be data-in / report-out
• Data retention beyond the active investigation without documented reason
• Inability to provide reference deployments with measurable coverage and throughput outcomes

This report combines public industry data with Hesper AI's own benchmarks. External statistics are attributed to their primary sources throughout. Figures labelled "Hesper AI benchmark" or "Hesper AI estimate" are Hesper's working estimates, drawn from its founders' conversations with SIU and claims leaders at US P&C carriers. They are not survey results, not published research, and not aggregated customer data. This page is the analysis; the insurance fraud statistics roundup collects the published numbers in one place.

Sources

• Coalition Against Insurance Fraud, The Impact of Insurance Fraud on the U.S. Economy (2022) - the $308.6B total and every line-level estimate in Part 1
• Insurance Information Institute - the late-1980s adjuster-interview estimate that fraud is about 10% of P&C incurred losses and LAE, as quoted in CAIF 2022 (p. 8)
• Insurance Research Council (2015) - fraud and buildup at 15-17% of auto bodily injury claim payments, 2012 data, as cited in CAIF 2022 (p. 8)
• Verisk (2017) - auto premium leakage estimate ($29B), an underwriting figure, as used in CAIF 2022's premium avoidance line
• Signicat, The Battle Against AI-Driven Identity Fraud (February 2025) - deepfake share of fraud attempts detected by Signicat, a European identity-verification vendor
• National Association of Insurance Commissioners (NAIC) - Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (December 2023) and the Unfair Claims Settlement Practices model act
• Hesper AI benchmarks - 14+ days per manual investigation, 200+ cases per investigator, ~25% of flagged claims fully investigated, 15-40% SIU confirmation rates, and the workload-split, cost-per-case and signal-count estimates. Working estimates from conversations with SIU and claims leaders; not published research and not customer data.

Terms and definitions

Throughout this report, "fraud detection" refers to automated systems that flag suspicious claims for SIU review. "Fraud investigation" refers to the downstream process of confirming whether fraud occurred, gathering evidence, and producing a report that supports a claim decision. "Autonomous AI investigation" refers to systems that automate the evidence-gathering, analysis, and report-generation stages of investigation while preserving human decision authority on the final fraud determination.

Limitations

Operational benchmarks vary by carrier size, line of business, and claim mix. The numbers in this report are central tendencies and should be adjusted for specific carrier context during planning. ROI calculations in Part 6 use illustrative carrier profiles; actual carrier economics depend on flagged volume, average claim value, fraud rate, and current SIU cost structure.

Companion reading

State of Claims Automation 2026 covers the rest of the claim file rather than the fraud slice: what a US P&C claim costs to handle, how long it takes, the adjuster workforce projection, claims leakage and recovery, and which lifecycle stages a regulator has actually measured as automated. It is a synthesis of public data, with every figure traced to a named primary source. Both sit in the Hesper research reports index.

Hesper AI is the AI claims resolution platform: every claim from first notice to final recovery, with investigation-grade evidence behind every decision. Fraud investigation is one module. It has built-in fraud detection and also works downstream of existing detection systems (FRISS, Shift Technology, Verisk, or internal rules engines), running 15+ investigation phases in parallel on every flagged claim - document forensics, medical record analysis, OSINT, database cross-referencing, statement analysis, timeline reconstruction, network analysis, and report generation - and producing investigation-ready output in minutes, not weeks. See how the fraud investigation module works.

We are based in the US, founded in 2024, and support all major P&C lines of business plus specialty, life-and-health, and consumer lines. Our deployment model is API-integrated with existing claims management systems and does not require replacement of current detection or claims stacks.

© 2026 Hesper AI. Published April 19, 2026; sources corrected September 27, 2026. All data sources cited inline. Redistribution permitted with attribution.