Fraud & SIU

Insurance fraud is the one claims problem where the law obliges the insurer to look, to staff, to train, to report and to keep paying honest claims on time while it does. Most states require insurers to run a special investigations unit (SIU) or an anti-fraud plan, to refer suspected fraud to a state fraud bureau within a set number of days, to put a fraud warning on claim forms, and to file an annual report on what the unit did. The same states protect reports made in good faith from civil liability and fund fraud bureaus with assessments on insurers. Meanwhile the claim clocks keep running: a suspicion is not a reason to delay a claim unless a specific rule says so, and an SIU referral that sits for a month on a claim that turns out honest is a late claim.

This chapter covers the size of the problem as its advocates measure it, the model act, state SIU and reporting rules in California, New York, Florida and Texas with the reporting clocks compared, fraud bureaus and the industry claim database, detection with rules, models and networks, rings and staged accidents, fraud at application, and how investigations interact with the claim clocks. The general mechanics of scoring, bands and decision records are in Risk Scoring; payments-side fraud is in Fraud & Risk; marketplace fraud from the platform's side is in Marketplace Fraud.

How the Platforms Do It#

As of November 2026, from filings, regulator pages and vendor sites (vendor figures are marketing):

The pattern: an industry-wide match (has this person, car, address or provider appeared on other claims), a carrier-side score (rules and models over the claim's own facts), network links across claims, and an SIU workflow that turns a referral into an investigation and, where warranted, a report to the state.

The Size of It#

The figures are advocacy estimates, and I cite them as such. The Coalition Against Insurance Fraud says fraud "steals at least $308.6B every year from American consumers" and appears in about 10% of property-casualty losses; the page doesn't give a study year or method. NAIC's consumer page repeats the $308.6 billion and cites the FBI's estimate that fraud costs a family between $4,000 and $7,000 in increased premiums over ten years. No regulator publishes an audited national figure, which is a reason to measure an insurer's own program by its outputs (referrals, confirmed fraud, savings, reports filed) rather than by a share of a national number.

The Legal Frame#

NAIC's Insurance Fraud Prevention Model Act (Model 680), adopted in 1995 and amended through 2003, replaced earlier models from 1980 and 1983 and sets the pattern most states follow:

• Mandatory reporting. "A person engaged in the business of insurance having knowledge or a reasonable belief that a fraudulent insurance act is being, will be or has been committed shall provide to the commissioner the information required by, and in a manner prescribed by, the commissioner"; others may report (Section 6). The model sets no number of days; states do.
• Immunity. No civil liability for furnishing information about suspected fraud to the commissioner, law enforcement, the NAIC or anti-fraud organizations, except for statements made with actual malice (Section 7).
• Warnings. Claim forms and applications carry a warning that "any person who knowingly presents a false or fraudulent claim for payment of a loss or benefit or knowingly presents false information in an application for insurance is guilty of a crime and may be subject to fines and confinement in prison" (Section 4).
• A state fraud unit with investigators (Section 9), and insurer antifraud initiatives "reasonably calculated to detect, prosecute and prevent fraudulent insurance acts," which may be fraud investigators (employees or contractors) or an antifraud plan filed with the commissioner; plans are confidential and not public records (Section 11).

By the Coalition's March 2020 count, 42 states and DC have an insurance fraud bureau, 43 states and DC require insurers to report suspected fraud, and 48 states make insurance fraud a specific crime. That data is six years old, so treat the counts as approximate as of November 2026.

State Requirements#

As of November 2026, from each state's statute and regulation:

Statuses: California's SIU regulations were last amended effective October 1, 2020; Florida's sections were last amended by ch. 2025-4; Texas's chapters 701 and 704 took effect April 1, 2005, with 701.051 amended later in 2005; New York's Ins. Law 409 and 405 show 2014 revisions on the Senate site. The New York conflict between the statute's March 15 and the regulation's January 15 annual report date is in the texts as published; my rule is to file by the earlier date.

Worked Numbers: Reporting Clocks From One Determination

Mine. An insurer's SIU concludes on Monday, March 1, 2027 that an auto theft claim was probably fraudulent.

The trigger is the same word in three states ("determination"), and it is the SIU's conclusion, not the first red flag, so the system has to record when the determination was made and by whom. California's regulation requires the referral to say whether the investigation is complete (2698.37(d)), so an early report of an open investigation is lawful and is often the safer choice.

Fraud Bureaus and the Industry Database#

State fraud bureaus are law enforcement agencies inside or beside the insurance department. California's Fraud Division, established in 1979, has more than 266 staff in headquarters and nine regional offices and programs for auto, workers' compensation, property and life, and disability and health care fraud, funded by insurer assessments rather than the general fund. Texas's insurance fraud unit exists "to enforce laws relating to fraudulent insurance acts" (Ins. Code 701.101). Florida's reports go to the Division of Criminal Investigations; reporters there are immune from civil liability "in the absence of fraud or bad faith" (626.989(4)(c)).

The industry database is the other half. Insurers report claims to Verisk's database, which matches each new claim on identity fields and returns the prior claims of the same people, vehicles and businesses, so an adjuster sees that this claimant had three soft-tissue claims in two years with the same clinic. Verisk also notes its database helps insurers meet state and federal reporting checks such as delinquent child support liens. The rule for the system is the record-linkage one: the match report is evidence for a person to weigh, with its match quality, never an automatic denial (Probabilistic Linkage).

Detection#

California's regulation describes the structure most programs share. "Integral anti-fraud personnel" (adjusters, underwriters, intake staff) are responsible for identifying suspected fraud; the SIU keeps written red flags "specific to each line of insurance, or each insurance product" (2698.35); a referral is credible if it has at least one red flag, and the SIU "shall investigate each credible referral" with file analysis, interviews, industry database checks, evidence preservation and a written summary (2698.36). The regulation defines a reasonable belief of fraud as objective justification based on articulable facts (2698.30).

Automation sits on top: rules for known red flags (a policy bound days before the loss, a theft of a car with a large loan balance, a claimant represented within hours), predictive models over claim features, and network analytics that link claims sharing phone numbers, addresses, vehicles, providers or attorneys. Three governance rules from the playbook apply with insurance weight:

• A score routes; a person decides. A referral, a recorded statement or an examination under oath can follow a score; a denial needs facts in the file that a market conduct examiner and a court will accept (Scores, Bands and the Human Middle).
• Labels arrive late. Confirmed fraud is known months after the claim, if ever, and most honest claims are never labeled honest (Labels Arrive Late).
• Models are AI systems under the regulators' rules. A claims fraud model is within the NAIC AI bulletin's scope where adopted, and within Colorado's and New York's rules on external data and unfair discrimination (Data, AI & Privacy Rules). FRISS's and Shift's marketing about false positives is the regulators' concern from the other side: every false positive is an honest claimant delayed.

Rings and Staged Accidents#

Organized fraud is where the network matters. California's department publishes cases from its auto fraud task forces: four friends who "deliberately crashed their vehicles into one another" in Upland in June 2025 and then sought treatment to inflate injury claims (an estimated $36,000 loss, charged in May 2026); a second car that intentionally hit a rideshare vehicle on I-215 so its riders could file bodily injury claims against the driver's insurer (four pleaded no contest, November 2025); and a person in a bear costume who "attacked" luxury cars for a total loss to insurers of $141,839 (April 2026). Florida's criminal statute grades the offense: organizing, planning or participating in a staged crash is a second-degree felony with a civil penalty of $15,000 to $50,000 and a minimum of 2 years' imprisonment, soliciting with intent to defraud is a second-degree felony, and general insurance fraud is graded by value, third degree under $20,000, second degree from $20,000 to $99,999 and first degree at $100,000 or more (Fla. Stat. 817.234).

Rings show up as shared entities across claims that look independent one at a time: the same clinic, the same lawyer, the same tow company, the same phone number on different claimants, the same vehicle in several losses. Detecting them needs the claims of many insurers (the industry database and NICB) and the parties on each claim modeled as linked entities, not free text.

Fraud at Application#

Verisk describes its customers' need to "fight insurance fraud -- both in claims and at policy inception." Application fraud in personal lines is mostly rate evasion: a garaging address in a cheaper territory, an undisclosed household driver, a business use described as personal, prior losses not disclosed. It is detected at quote with the same data that rates the policy (prefill, MVRs, loss history; Consumer Reports & Third-Party Data) and at claim, when the loss reveals the real garaging address or driver. What the insurer may do then, rescind, reform the premium, or deny, is a matter of each state's misrepresentation law and the policy, and it is also a coverage position with its own notice deadlines (First Notice, Coverage & Triage). Model 680's warning covers "false information in an application" as well as false claims.

Investigations and the Claim Clocks#

An SIU referral doesn't stop the clock unless a rule says it does, and the rules that do are narrow:

• NAIC Model 902 relieves the insurer of the 21-day decision and 45-day letters only where "there is a reasonable basis supported by specific information available for review by the insurance regulatory authority" that the claimant fraudulently caused or contributed to the loss.
• California extends the 40-day decision to 80 days on a documented, reasonable suspicion of fraud, and its delay notices need not disclose information that could compromise the investigation (10 CCR 2695.7(c)(2), (k)).
• Texas gives 30 days instead of 15 business days when the insurer has a reasonable basis to believe the loss resulted from arson (Ins. Code 542.056(b)).
• Florida treats the policyholder's fraud, lack of cooperation or intentional misrepresentation as a factor beyond the insurer's control (627.70131(5)(a)).

So the SIU's work runs in parallel: the adjuster keeps the claim on its clocks, the SIU documents the specific information that would justify an extension, and the extension, if taken, is an event with that documentation attached (Catastrophe Extensions and Tolling). The fraud warning on the claim form is also a rule with state text: New York's carries a civil penalty "not to exceed five thousand dollars" plus the claim's value and goes immediately above the signature (11 NYCRR 86.4), and Texas requires a warning in comparative prominence on claim forms (Ins. Code 704.002).

How to Build It#

These are deltas against The Core Data Model: claims, exposures, parties and claim_tasks. This chapter adds fraud_referrals, siu_investigations and fraud_reports.

CREATE TABLE fraud_referrals (             -- a red flag or score that reached the SIU
  id                 UUID PRIMARY KEY DEFAULT uuidv7(),
  claim_id           UUID REFERENCES claims (id),
  submission_id      UUID,                  -- application fraud, when at quote
  source             TEXT NOT NULL CHECK (source IN ('adjuster', 'underwriter', 'rule',
                       'model', 'industry_match', 'network', 'tip', 'law_enforcement')),
  red_flags          TEXT[] NOT NULL,       -- codes from the line's written red flag list
  model_version_id   UUID,                  -- model_versions (Data, AI & Privacy Rules)
  score              NUMERIC,
  credible           BOOLEAN NOT NULL,      -- at least one red flag (10 CCR 2698.36)
  referred_by        UUID NOT NULL,
  referred_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  disposition        TEXT CHECK (disposition IN ('accepted', 'declined', 'merged'))
);

CREATE TABLE siu_investigations (
  id                 UUID PRIMARY KEY DEFAULT uuidv7(),
  referral_id        UUID NOT NULL REFERENCES fraud_referrals (id),
  investigator_id    UUID NOT NULL,         -- employee or contracted SIU
  contracted_vendor  TEXT,
  steps              JSONB NOT NULL DEFAULT '[]',  -- interviews, EUO, database checks,
                                                   -- evidence preserved, each dated
  linked_claim_ids   UUID[] NOT NULL DEFAULT '{}', -- network or ring links
  determination      TEXT CHECK (determination IN ('suspected_fraud', 'no_fraud',
                       'insufficient_evidence')),
  determined_at      TIMESTAMPTZ,           -- starts the reporting clocks
  determined_by      UUID,
  summary_document_id UUID,                 -- the written summary
  savings_amount     BIGINT,                -- for the annual report
  closed_at          TIMESTAMPTZ
);

CREATE TABLE fraud_reports (               -- each report to a state, and its clock
  id                 UUID PRIMARY KEY DEFAULT uuidv7(),
  investigation_id   UUID NOT NULL REFERENCES siu_investigations (id),
  state              TEXT NOT NULL,
  agency             TEXT NOT NULL,         -- 'CDI Fraud Division', 'NY DFS IFB', 'TDI', ...
  rule_ref           TEXT NOT NULL,         -- 'Cal. Ins. Code 1872.4', 'N.Y. Ins. Law 405'
  due_at             TIMESTAMPTZ NOT NULL,  -- from determined_at
  form               TEXT,                  -- 'IFB-1', department form, portal
  investigation_complete BOOLEAN NOT NULL,  -- CA 2698.37(d)
  submitted_at       TIMESTAMPTZ,
  confirmation_ref   TEXT,
  via_organization   TEXT                   -- TX: through an anti-fraud organization
);

Design choices:

• The SIU lives beside the claim, not inside it. Investigation notes are restricted to the SIU and counsel; the claim shows that a referral exists and what the adjuster must do, not the evidence, because delay notices mustn't tip off a suspect and because access is logged (Log Access, Not Just Changes).
• The determination is the dated event that creates the reports, one per state whose rule applies (the loss state, and sometimes the insured's state).
• Red flag lists are versioned per line and product, as California requires them written, and referrals cite the codes.
• Annual reports are queries over referrals, investigations, determinations, savings and reports by state and year.

Auditing#

• Every referral with its source, red flags, model version and score, credibility and disposition.
• Every investigation with its steps, investigator (employee or contractor), determination, its date and its summary.
• Every state report with the rule, due date, submission time and confirmation, and late reports as exceptions.
• Training records by person against each state's hours (California's 90-day orientation and 5 annual hours, Florida's 2 and 1).
• Claim clock extensions taken for fraud with the documented basis, and claims that were referred but paid on time anyway.

What This Means for the System You Build#

• Capture red flags as coded data from versioned per-line lists, from people and from rules.
• Run scores and matches as referrals for people to investigate, never as denials, and govern the models as AI systems.
• Start state reporting clocks from the SIU's dated determination, per state: 30 days in New York and Texas, 60 in California.
• Keep the claim on its clocks during investigation, and take a fraud extension only with documented specific information.
• Separate SIU records from the claim file with logged access.
• Model parties and their links across claims so rings are visible.
• Produce annual SIU reports and training records from the data, by state.

References#

Law and regulation

• Cal. Ins. Code 1872.4 (FindLaw), reports to the Fraud Division within 60 days after the insurer's determination
• Cal. Ins. Code 1872.8 (FindLaw), the vehicle assessment and its split
• Cal. Ins. Code 1875.20 (FindLaw), the continuous SIU requirement for admitted insurers
• 10 CCR 2698.30, 2698.33, 2698.35, 2698.36, 2698.37, 2698.39 and 2698.40, California's SIU regulations: definitions, contracted SIUs, red flags, credible referrals and investigation steps, referral contents, training hours and the annual report, amended effective October 1, 2020
• N.Y. Ins. Law 409, fraud prevention plans and SIUs for writers of 3,000 or more policies, investigator qualifications, approval, penalties and the annual report
• N.Y. Ins. Law 405, reports within 30 days after determination
• 11 NYCRR 86.4, 86.5 and 86.6, Regulation 95: the warning statement, form IFB-1 and plan contents and annual report
• Fla. Stat. 626.9891, anti-fraud units and plans, reporting to the Division of Criminal Investigations, training hours, annual data and penalties; last amended by ch. 2025-4
• Fla. Stat. 626.989, the reporting duty and immunity absent fraud or bad faith
• Fla. Stat. 817.234, staged crashes, solicitation and value-graded insurance fraud penalties
• Tex. Ins. Code 701.051 and 701.101, reports within 30 days and the fraud unit's purpose
• Tex. Ins. Code 704.051, 704.052 and 704.002, antifraud plans, their contents and the claim form warning

NAIC

• NAIC: Insurance Fraud Prevention Model Act (#680) (PDF), mandatory reporting, immunity, warnings, the fraud unit and insurer antifraud initiatives, and the model's history
• NAIC: Insurance fraud, the $308.6 billion figure, the FBI premium estimate, fraud bureau counts and OFRS

Regulators and guidance

• California Department of Insurance: Fraud Division overview, staff, offices, programs, founding and funding
• California Department of Insurance: release of May 27, 2026, the Upland staged collision case
• California Department of Insurance: release of November 21, 2025, the I-215 rideshare staged collision case
• California Department of Insurance: release of April 16, 2026, the costume vandalism case and its $141,839 loss
• Texas Department of Insurance: Fraud, industry reporting and consumer reports through OFRS

Filings

• Verisk: 2025 Annual Report and Form 10-K (PDF), the claims database's size, daily submissions, match fields, analytics, users and fraud at policy inception
• ProPublica Nonprofit Explorer: National Insurance Crime Bureau, NICB's tax status, location and fiscal 2025 revenue and expenses

In practice

• Coalition Against Insurance Fraud: Fraud stats, the $308.6 billion and 10% estimates and the March 2020 state counts
• Shift Technology, customers and volumes analyzed
• FRISS, real-time scoring, implementations and false positive claims