# Building Fraud Detection Models on Claims Data
A bodily-injury claim lands on an adjuster's desk: a rear-end collision, three occupants, all reporting soft-tissue neck injuries, all treated at the same clinic, all represented by the same attorney within 48 hours of the accident. Individually, nothing is illegal. Together, it is a textbook signature of an organized fraud ring.
Your job as the data person is to teach a model to see that pattern, and to do it without flagging the thousands of legitimate whiplash claims that look superficially similar.
Insurers have used rules for decades. A rule says: "flag any claim over $10,000 with treatment starting more than 30 days after the accident." Rules are transparent and easy to audit, but fraudsters learn them and stay just under the threshold.
Soft fraud (exaggerating a real claim) and hard fraud (a fully staged or fabricated loss) both evolve. The interesting, expensive fraud is organized: rings of providers, attorneys, and "patients" who recycle the same playbook across many claims.
That is a pattern problem. And patterns across thousands of claims are exactly what data models are good at.
The Coalition Against Insurance Fraud publishes solid, free background on how these schemes work. Skim their fraud resources before designing features; understanding the crime makes you better at engineering signals for it.
Beginners model "the claim." Fraud rings live *between* claims. So you actually need three levels:
A single suspicious claim tells you little. The same chiropractor appearing on 200 low-speed rear-end claims with near-identical treatment plans tells you a lot.
Let us convert our opening claim into features a model can read.
This is where organized fraud shows up.
None of these is proof. Each is a weak signal. The model's job is to combine many weak signals into a calibrated risk score.
Standard tabular models miss the connective tissue. Fraud rings are naturally a graph: nodes are people, clinics, vehicles, phone numbers, and bank accounts; edges are shared claims.
Build the graph, then compute features from it:
import networkx as nx
# Nodes: claimants, providers, attorneys, phones, VINs
# Edges: appears-on-same-claim or shares-attribute
G = nx.Graph()
G.add_edge("claimant_A", "clinic_9")
G.add_edge("claimant_B", "clinic_9")
G.add_edge("claimant_A", "phone_555")
G.add_edge("claimant_B", "phone_555") # suspicious shared attribute
# Find tight clusters that recur across claims
components = list(nx.connected_components(G))
suspicious = [c for c in components if len(c) > 15]A cluster of fifteen "strangers" all routing through one clinic and one phone number is the ring. That structural fact is a feature you feed into the downstream model.
You rarely have clean fraud labels. Confirmed fraud is a tiny, biased slice: only the cases someone already caught. So use a layered approach.
Train on confirmed fraud (investigated and proven) plus confirmed legitimate claims. Gradient-boosted trees (XGBoost, LightGBM) handle mixed features well and give feature importances adjusters can inspect. Good for catching *known* patterns.
The weakness: they only learn fraud that looks like past fraud.
For novel schemes, use anomaly detection: isolation forests, autoencoders, or clustering. These flag claims that deviate from normal without needing labels. The goal is not to declare "fraud"; it is to say "this is statistically unusual, look closer."
Most mature insurers run both: a supervised score for known typologies, an anomaly score for the unknown, and graph features feeding both. A claim that is high on all three goes straight to the Special Investigations Unit (SIU), the internal team that investigates suspected fraud.
Here is the trap. Suppose fraud is roughly 10 percent of claims (a commonly cited estimate; real rates vary by line and are hard to measure precisely because undetected fraud is, by definition, uncounted).
If your model flags 30 percent of claims to "be safe," you have buried your SIU. Adjusters lose trust, ignore the alerts, and the whole system dies. This is alert fatigue, and it kills more fraud programs than bad math does.
Two disciplines fix this:
1. Optimize for precision at low volume. You do not need to catch every fraud. You need the top 2 percent of flagged claims to be genuinely worth an investigator's time. Measure precision at k: of the top 100 claims you flag, how many are real? That is the number your SIU cares about.
2. Make scores explainable. An adjuster will not act on "the model said 0.87." Give reasons: "same clinic on 180 claims, three occupants co-appeared on a prior loss, attorney retained in 6 hours." Tools like SHAP values turn a score into a short list of drivers. Explainability is also increasingly a regulatory expectation, since flagging a policyholder as suspicious has real consequences.
Fraud models touch protected decisions. A few guardrails:
The NAIC (National Association of Insurance Commissioners) has ongoing guidance on the use of AI and data in insurance; it is worth tracking as expectations tighten through 2026.
Knowledge check
1. Why does the lesson argue that fraud detection is fundamentally a data problem rather than a rules problem?
2. A single low-speed rear-end claim with soft-tissue injuries is, on its own, hard to distinguish from legitimate whiplash. What does this illustrate about the appropriate unit of analysis?
3. The lesson warns against flagging the 'thousands of legitimate whiplash claims that look superficially similar' to fraud. What core modeling concern does this highlight?
4. Select ALL correct answers. According to the lesson, which levels of analysis are needed to detect organized fraud rings?
Select all the correct answers.
5. Select ALL correct answers. What is true about the distinction between soft fraud and hard fraud as described in the lesson?
Select all the correct answers.
A fraud model is not "trained once." Every SIU investigation produces a new label: fraud confirmed, or cleared. Feed those outcomes back.
Two cautions:
Our opening claim: three occupants, one clinic, one fast attorney, all soft-tissue. Run it through the stack:
Combined score: high, with three explainable drivers. It routes to SIU with a clear rationale, and the ten legitimate whiplash claims processed that same afternoon (single occupant, normal treatment cadence, no shared entities) sail through untouched.
That is the goal: catch the ring, spare the honest claimant, respect the adjuster's time.