Fraud checks and investigations

Fraud checks run on every new claim. They do not accuse anyone: they point a person at what deserves a second look, and they keep track of which checks turn out to be right.

The indicators

Each rule that fires leaves a flag with a score and a plain reason:

Rule	When
Looks like an earlier claim	same policy, date, kind of loss and amount within 10%
Provider invoice already claimed	the same provider invoice number on another claim
Loss soon after cover started	within 30 days of a new policy (not a renewal)
Loss in the last days of cover	in the last 15 days of a policy that is not renewed
Loss soon after the sum insured went up	within 30 days of an increase
Reported long after the loss	more than 30 days later
Many claims in a year	three or more by the same customer
Amount far above similar claims	2.5 times the average of at least five similar claims
Amount close to the sum insured	90% or more, when not a total loss
Bank account shared	the customer's account is also someone else's
Third party or vehicle seen before	on another customer's claim
Watchlist or blacklist	any name, ID, phone, email, plate, provider or account on a list

The claim's fraud score is the total. From 30 it is flagged for review and the fraud team is told. From 60, or on a blacklist hit, payments are held.

Reviewing

Fraud > Fraud review lists the flags. Mark each one Real or False alarm. When every flag of a claim is a false alarm, the claim is cleared and payments are released. Rule hit rates shows, per rule, how often it was right: a rule that mostly raises false alarms is costing your team time.

Run fraud checks on a claim runs them again, for example after adding people involved.

Investigations

Investigate on a claim opens an investigation, holds payments and tells the investigator. Fraud > Investigations > Close records the findings and the outcome:

• Fraud confirmed: the flags are confirmed and an unpaid claim is rejected.
• Not fraud or Inconclusive: the flags are recorded as false alarms and payments are released.

Record the amount saved: it shows what the work is worth.

Watchlists and blacklists

Fraud > Watchlists holds people, ID numbers, phones, emails, bank accounts, vehicles and providers to look out for (watchlist) or refuse (blacklist), each with a reason and an optional end date. Spaces, dashes and capitals do not matter when matching.

Bank account changes

Changing where money is paid is a classic fraud. A new or changed bank account on a customer or provider waits under Fraud > Bank account checks until someone other than the person who entered it confirms it with the owner through a channel already trusted (a call back on a number on file, a bank letter). Until then payments keep going to the old verified account, and a claim payment to an unverified account is refused. Account numbers are stored encrypted and never appear in the audit trail.