IAI SP6 cheat sheet

Fraud is intentional deception for gain; dishonesty plus intent plus benefit distinguishes it from error, negligence or legitimate dispute.

First-party (claims) fraud: policyholder exaggerates, fabricates or stages a loss; third-party fraud targets the insurer from outside, e.g. staged accidents and organised rings.

Internal fraud is committed by employees or agents (fictitious claims, premium theft, collusion); intermediary fraud sits with brokers and MGAs.

Typologies: staged/induced accidents, ghost or fictitious claims, premium diversion, application (underwriting) fraud, claims inflation/padding, identity fraud, insider collusion, cyber-enabled fraud.

Claims padding (build-up) adds genuine but inflated items; fabrication creates wholly non-existent loss elements; both are first-party typologies.

Scale is estimated by detection rate, claim leakage studies, industry fraud-bureau returns and insurer self-reporting; all understate true volume because undetected fraud is unobserved.

Fraud indicators cluster: soft fraud (opportunistic inflation) is common and low sophistication; hard fraud (organised staging) is rarer, higher value and frequently linked to networks.

Costs fall on honest policyholders through higher premiums; fraud also creates claims-handling cost, reputational exposure and regulatory scrutiny.

Fraud is a criminal offence of dishonesty; civil remedies include avoidance of the contract, restitution, damages for deceit and recovery of overpayments.

Insurers have a duty to handle claims fairly (e.g. treating customers fairly / consumer duty principles); suspected fraud must be investigated proportionately and without prejudicing legitimate claim elements.

Data protection law (GDPR/UK GDPR or local equivalent) governs processing of fraud data; fraud prevention is a recognised legitimate interest and lawful basis, but fairness and transparency still apply.

Fraud databases and information sharing (e.g. national fraud bureaux, Insurance Fraud Enforcement bodies) operate under data-sharing agreements and statutory gateways.

Money laundering and terrorist financing rules require customer due diligence, suspicious activity reporting and record-keeping; fraud and laundering frequently overlap.

Regulators require senior management to own fraud risk (SMCR-style accountability or equivalent), with documented fraud risk appetite and reporting.

Whistleblowing protections and reporting obligations apply to employees who report internal or external fraud.

Evidence must be lawfully obtained; unlawfully obtained evidence may be excluded or undermine a prosecution or a civil recovery action.

Application inconsistencies: mismatched addresses, employment, dates, or details that change between quote and proposal.

Reluctance to provide verification documents (proof of address, no-claims evidence, mileage records) or repeated document substitutions.

Premium and payment signals: immediate cancellation after inception, payment from third-party accounts, or repeated failed direct debits.

History indicators: prior declined or voided policies, undisclosed claims, frequent insurer switching, or lapsed cover before a claim.

Risk mismatch: declared low-risk occupation or usage inconsistent with sum insured, vehicle type, or business activity.

Identity red flags: recently created email/phone, shared addresses across unrelated policyholders, or names inconsistent with payment instruments.

Intermediary red flags: unusual concentration of high-risk business, poor record-keeping, or pressure to bind cover quickly.

Underwriting controls: verify key data at point of sale, screen against fraud databases, and record rationale for accepting unusual risks.

Timing signals: claim notified immediately after inception, reinstatement or an increase in cover; delay in reporting a supposedly recent loss.

Loss circumstances: no witnesses, vague or inconsistent narrative, loss occurring in an unoccupied or unsecured location, or total loss of recently acquired high-value items.

Documentation red flags: altered or photocopied receipts, sequential invoice numbers, generic or template quotes, missing proof of ownership.

Medical/liability signals: symptoms disproportionate to mechanism of injury, treatment starting only after legal advice, or repeated claimants from the same clinic.

Repetition and linkage: same claimant, address, bank account, repairer or witness appearing across multiple claims.

Behavioural indicators: evasiveness, over-prepared answers, pressure for fast settlement, refusal to be interviewed, or hostility to document requests.

Financial motive: arrears, insolvency, recent large purchases, or a sum insured that closely matches a debt.

Red flags are indicators, not proof; each must be corroborated and recorded, and a cluster of independent indicators carries more weight than any single one.

Plan the investigation with defined scope, allegations, hypotheses and a documented rationale; proportionality is a legal and conduct requirement.

Evidence types: documentary (policy, receipts, medical records), digital (metadata, call logs, social media), physical (scene, damaged item), and testimonial (witness and claimant statements).

Preserve evidence with chain of custody: record who obtained, handled, stored and transferred each item, with dates and signatures.

Digital evidence: capture with hashes, retain originals, document the capture method, and observe privacy law when accessing social media or personal devices.

Open-source and surveillance evidence must be relevant, proportionate and lawfully obtained; covert surveillance requires authorisation and legal review.

Corroborate rather than rely on a single source; test the claimant's account against independent records (repairers, hospitals, employers, police).

Maintain contemporaneous investigation notes and a decision log; findings should distinguish established fact, inference and unresolved question.

Report outcomes to the appropriate decision-maker (claims, underwriting, financial crime) and, where required, to police or a fraud bureau.

Plan the interview: objectives, known facts, documents to be shown, and the sequence of topics; record the plan.

Use open questions first to obtain a free account, then probe with specific and closed questions; avoid leading questions that suggest answers.

Cognitive interview techniques (context reinstatement, reverse order recall, change of perspective) improve recall accuracy without suggestion.

Record the interview accurately (contemporaneous notes or recording), with time, date, location, participants and breaks noted.

Statements should be in the witness's own words, read back and signed, with corrections initialled; never draft a statement the witness has not verified.

Use caution when the interviewee may face criminal liability; they have rights (legal representation, silence, against self-incrimination) that must be respected.

Detect deception through inconsistency, evasiveness and changes of detail, not through demeanour alone; demeanour is an unreliable indicator.

Close the interview by summarising, allowing correction, and confirming next steps and how the statement will be used.

Framework: identify fraud risks, assess likelihood and impact, set risk appetite, design controls, monitor and report - a continuous cycle.

Three lines of defence: business units own fraud risk (first), risk/compliance oversight (second), internal audit independent assurance (third).

Preventive controls: identity and document verification, fraud database screening, underwriting rules, segregation of duties, dual authorisation.

Detective controls: claims triage and red-flag scoring, data analytics, exception reporting, audit sampling, reconciliation of payments.

Corrective controls: recovery action, policy voidance, disciplinary process, referral to police, and lessons-learned feedback into rules.

Key risk indicators: claims frequency by channel, average claim value, referral-to-detection ratio, recovery rate, and time to detect fraud.

Governance: a named senior owner, fraud policy, training, whistleblowing channel, and board-level reporting of fraud losses and trends.

Control testing should be documented and periodic; controls that are not tested cannot be relied on as assurance.

Rules-based detection uses thresholds and red-flag logic (e.g. claim within 30 days of inception); transparent but prone to false positives and easy to game.

Predictive models (supervised learning) score claims by fraud probability using historical labelled cases; performance measured by precision, recall and ROC/AUC.

Unsupervised techniques (clustering, anomaly detection, network analysis) surface unknown patterns without labelled data.

Social network analysis maps links between claimants, addresses, bank accounts, repairers and witnesses to reveal organised rings.

Text mining and NLP extract signals from claim narratives, emails and documents; entity extraction links names and places.

Data quality and governance matter: incomplete, biased or mislabelled data undermines model accuracy and fairness.

Alert triage and case management: scores must feed a workflow with investigator review, feedback and model retraining.

Model risk management: document models, validate performance, monitor drift and record decisions affecting customers.

Act with integrity and honesty; do not misrepresent findings, suppress exculpatory evidence, or overstate suspicion.

Treat claimants fairly and proportionately; suspicion of fraud does not remove the duty to pay legitimate elements of a claim.

Avoid conflicts of interest; declare personal or financial links to claimants, repairers or investigators and recuse where necessary.

Maintain confidentiality of personal and investigation data, sharing only on a need-to-know and lawful basis.

Competence and due care: work within your expertise, keep knowledge current, and seek specialist input where required.

Document decisions and rationale so that actions are transparent and auditable; a decision that cannot be explained is a conduct risk.

Non-discrimination: fraud indicators must be evidence-based, not based on protected characteristics or stereotypes.

Report suspected wrongdoing through proper channels and cooperate with regulators and law enforcement within legal limits.

Fraud is intentional deception for gain; dishonesty plus intent plus benefit distinguishes it from error, negligence or legitimate dispute.

First-party (claims) fraud: policyholder exaggerates, fabricates or stages a loss; third-party fraud targets the insurer from outside, e.g. staged accidents and organised rings.

Internal fraud is committed by employees or agents (fictitious claims, premium theft, collusion); intermediary fraud sits with brokers and MGAs.

Typologies: staged/induced accidents, ghost or fictitious claims, premium diversion, application (underwriting) fraud, claims inflation/padding, identity fraud, insider collusion, cyber-enabled fraud.

Claims padding (build-up) adds genuine but inflated items; fabrication creates wholly non-existent loss elements; both are first-party typologies.

Scale is estimated by detection rate, claim leakage studies, industry fraud-bureau returns and insurer self-reporting; all understate true volume because undetected fraud is unobserved.

Fraud indicators cluster: soft fraud (opportunistic inflation) is common and low sophistication; hard fraud (organised staging) is rarer, higher value and frequently linked to networks.

Costs fall on honest policyholders through higher premiums; fraud also creates claims-handling cost, reputational exposure and regulatory scrutiny.