Red flags in insurance claims: why a list of flags is not a referral

Red flags in insurance claims are facts, circumstances or patterns that suggest a claim may be fraudulent: a policy bought days before the loss, a prior claim at the same address, receipts that do not fit together, a loss reported long after it happened. California's regulation defines a red flag as a fact or pattern that, alone or with others, allows an inference of possible fraud. A red flag is a reason to look, not a finding, and a list of flags is not yet a referral. The step between them is testing each flag against the innocent explanation that might sit in the same file, and writing down what the test found. Botminds' Claims Fraud Detection does that for every new claim: it matches the file against the insurer's approved red-flag list, looks for what explains each flag innocently, lowers the score when it finds it, and shows every check, found or not, to the special investigations unit (SIU).

What are red flags of insurance fraud?

A red flag is any fact, circumstance or pattern that, alone or with others, makes fraud a reasonable possibility. California's regulation spells it out: "facts, circumstances, or events which, singly or in combination, support(s) an inference that insurance fraud may have been committed, and includes patterns or trends that may indicate fraud, facts or circumstances present on a claim, and behavior or history of person(s) submitting a claim or application" (10 CCR § 2698.30(n)).

The same section lists the kinds of evidence suspected fraud tends to leave. Suspected insurance fraud "includes any misrepresentation of fact or omission of fact pertaining to a transaction of insurance," and the facts it lists run from forms that were doctored, altered or destroyed, through the history of the people involved, receipts and estimates, to unusual policy activity and an untruthful application (§ 2698.30(q); the document-heavy part of that list is worked through in fake insurance claim documents). The NAIC's antifraud plan guideline uses almost the same list, and adds, as California does, that "A claim may contain evidence of suspected insurance fraud regardless of the payment status" (NAIC GL-1690).

Are red flags proof of fraud? No: the bar for proof is set higher on purpose

Red flags are not proof, and California writes the difference into two definitions. A red flag only has to make fraud an inference someone could draw. Reasonable belief, the bar for reporting to the state, is "a level of belief that an act of insurance fraud may have or might be occurring for which there is an objective justification based on articulable fact(s) and rational inferences therefrom" (§ 2698.30(m)). The red flag starts an investigation; articulable facts end one.

The Department's own SIU compliance training makes the line concrete on a sample auto claim: a single-vehicle accident reported on 1 January 2023 on a policy written on 27 December 2022. It lists what counts as a red flag and, separately, what establishes reasonable belief (CDI SIU compliance training).

Every item on the left is a fact that could be innocent: people do buy insurance just before accidents, neighbours misremember, databases mismatch, and claimants withdraw for many reasons. Every item on the right is a document that fixes a date or an image in time. A referral that stops at the left column asks the SIU to do the whole investigation; one that has tested the left column against the file hands the SIU a head start, which is where the SIU referral form earns its keep.

Flag, test, write down: why the innocent explanation belongs in the file

A flag tested against its innocent explanation is worth more than two untested ones, for three reasons. The SIU may close a referral at preliminary review only when it is reasonably clear the flags are not fraud, and it must then record its reasons in the claim or SIU file (§ 2698.36(c), set out in full in the guide to the SIU referral form); the test supplies the reasons. The claimant is spared an investigation the file could have prevented. And the referrals that survive the test are the ones investigators trust.

The search has to be honest about what it did not find. In Claims Fraud Detection the innocent-explanation checker "Never removes a reason" and "Shows every check it made, found or not." On the sample burglary claim it found two explanations and subtracted them, a police report on file (−40) and a hotel receipt for the trip the insured described (−28), and it showed the checks that came up empty: no lapse letter, cancellation or prior-carrier notice anywhere in the file to explain why no prior insurer was declared on a home owned since 2019.

What are common fraud indicators in insurance claims? A sample list, with the test for each

Common indicators cluster around timing, history, documents, the story and the claimant's circumstances, and each has an innocent version worth checking first. The table draws its flags from the fictional sample carrier's queue in Claims Fraud Detection, one claim per row; the tests are what the solution looks for before it lets a flag count.

Two flags in that table point beyond one claim. Four passengers at one provider is often the first visible edge of a staged-collision ring, and the sample carrier's state report on one such ring describes five claims sharing "one clinic, one law firm and two drivers who appear as claimant in one claim and witness in another." Reading across claims is a different job, covered in fraud ring detection. Receipts that look altered, rather than merely out of sequence, belong to document examination, covered in fake insurance claim documents.

What red flags do adjusters look for in theft claims?

In theft claims adjusters look hardest at timing, ownership and the paper behind the items. The sample burglary carried six flags from the carrier's list: the policy bought nine days before the loss (+190); an earlier theft at the same address, paid to another household member in March 2024 (+170); two jewelry receipts numbered 004417 and 004418 but dated 14 February and 2 October 2025, 230 days apart, both paid in cash (+140); the loss reported ten days after it happened (+110); jewelry claimed at $18,400 when the application said none over $1,500 (+90); and no forced entry, with the police report filed online nine days later (+60).

A documents flag, tested in Claims Fraud Detection: two receipts in sequence, 230 days apart

Each of those flags has an innocent reading, and the file was searched for it. The late report came with the insured's own words on the claim, "wanted to make a list first," which is plausible after a burglary and is why the carrier's fraud manager was already reviewing how much that flag should weigh when a police report was filed promptly. Here the police report came nine days after the loss, so the flag stood. The jewelry flag is also a coverage fact: the declarations show a $1,500 special limit for theft of jewelry with nothing scheduled. What that limit pays is the adjuster's question, not the fraud score's.

Singly or in combination: why one flag rarely carries a referral

California's definition says "singly or in combination," and in practice combination does the work. Any one of the six flags on the sample claim has a common innocent version; together, and with their tests passed, they made a referral the intake analyst accepted. Points make the combination visible: a baseline of 120 for homeowners theft, 760 from the six flags, 68 off for the two explanations, 812 against a referral line of 600.

Research on audit strategy reaches the same structure. Dionne, Giuliano and Picard rank fraud signals by how much each raises the probability of fraud, and show that the best policy refers a claim once certain indicators appear, using a suspicion index and a threshold rather than any single flag (Dionne, Giuliano and Picard; their model is set against today's scores in fraud risk scoring models). The flag's own limit belongs on the page too. The sample's top flag carries it in plain words: "Not proof on its own — 41% of referrals with this indicator were confirmed last quarter."

A timing flag, its test and its limit, on one screen

Do insurers have to list red flags?

In California, yes, in writing and per line of business. The SIU must keep written procedures for detecting and referring fraud that include "a listing of the red flags to be used to detect suspected insurance fraud for the insurer," and those flags "shall be specific to each line of insurance, or each insurance product" (§ 2698.35(b)). Claims staff must be trained to recognise them every year (§ 2698.39).

Other states reach the same place by different routes. New York's fraud prevention plans must include the "Development of a fraud detection and procedures manual to assist in the detection and elimination of fraudulent activity," according to the Department of Financial Services (NY DFS). The NAIC guideline asks every antifraud plan to set out the criteria that send a claim to the SIU. A list that lives only in a training deck meets none of these well; a list with points, versions and outcomes meets all of them.

What is not considered an insurance fraud red flag?

Who the claimant is, and where they live, are not red flags; what the claim and the file show can be. California bars insurers from discriminating in claims settlement "based upon the claimant's age, race, gender, income, religion, language, sexual orientation, ancestry, national origin, or physical disability, or upon the territory of the property or person insured" (10 CCR § 2695.7(a)). A red-flag list that leans on a postcode, or on traits that stand in for one, invites exactly that discrimination.

The sample carrier's list locks out race, colour, religion, national origin, sex, marital status, age, disability, ZIP code or neighbourhood on its own, and credit-based insurance scores; every indicator must describe the claim, the policy or a documented fact about them. Two more things should not count as flags on their own: a prior claim, which in the sample needs a match on two identifiers and is "never treated as proof," and a fact the file already explains. The bias tests for a fraud score go further into proxies.

When a red flag stops earning its place on the list

A flag earns its place by being confirmed when it fires, and the list should change when the outcomes say so. The sample carrier's outcome tracker found three candidates in one quarter. "Reported more than 7 days after the loss" was confirmed on only 31 of 344 referrals where a police report was filed within 48 hours, so the proposal is to cut its points in that case. "Receipts numbered in sequence across different dates" was confirmed on 19 of 30, the highest rate on the list, so its points should rise. "Damage photos taken at night, location not shown" was confirmed on 3 of 71, because the carrier's camera app now records location on every photo, so the proposal is to retire it.

None of those changes happens on its own: the fraud manager and a second approver decide, after seeing what each change would have done to last quarter's referrals. A red-flag list maintained that way is the closest thing a carrier has to evidence that its flags mean what its training says they mean.

Questions people ask

What is a red flag in a claim?

A fact, circumstance or pattern that supports an inference that fraud may have been committed, alone or with others, in California's words. Examples are a policy bought days before the loss, a prior claim at the same address, inconsistent receipts or a late report. It is a reason to look further, not proof.

What red flags trigger an SIU investigation?

In California any credible referral does, and a referral counts as credible as soon as it carries at least one red flag (10 CCR § 2698.36(c)). The SIU may decline only where it is reasonably clear the flags are not fraud, and must write down why. Which flags lead to a referral in the first place is set by the insurer's written list for each line.

Do adjusters have to tell the claimant about red flags?

No. California's claims regulation (10 CCR § 2695.7) expressly spares the insurer from saying anything in its notices that would tip the claimant off to a fraud investigation; what a claimant can and cannot learn is set out in the guide to an insurance claim under review. The claim's other deadlines and notices still apply.

Who writes the red flag list?

The SIU. California requires it to "establish, maintain, distribute, and monitor written procedures" for claims staff, including the red flags for each line of business (10 CCR § 2698.35(b)). In Claims Fraud Detection the fraud manager owns the list; changes need a second approver and are released as versions.

How many red flags are needed before a referral?

No rule sets a number. The definition allows a single flag, but most single flags have innocent versions, so carriers usually weigh flags together, as points against a referral line or as a suspicion index. What matters more than the count is whether each flag survived its test.

Are red flags the same in every line of business?

No, and California requires them to differ: each line of insurance, or each product, needs its own list. A late report means something different in a theft claim, a workers' compensation claim and a liability claim, and so do the innocent explanations worth checking.