Case study · worked example on a fictional sample storm

Roofing scam after storm damage: one hail day, forty homes, 17 days

A roofing scam after storm damage rarely looks like a scam on any one claim; it looks like forty ordinary estimates. This worked example follows one fictional hailstorm through Botminds' Contractor Fraud Detection, day by day: when the copies could first be seen, when such schemes are usually found, and what holding the unpaid part on day 17 changed.

Updated · 13 min read

A roofing scam after storm damage usually works through the homeowner's insurance claim. A contractor signs homeowners at the door, often with a form that sends the insurance payment to the contractor, files an estimate for each house that bills more than the roof needs, and moves on, sometimes under a new business name, before anyone compares the estimates. Each claim looks normal. The scam is in the pattern: the same estimate on dozens of houses of different sizes. This page follows one such pattern through a fictional hailstorm in Collin County, Texas, as it runs through Botminds' Contractor Fraud Detection. The insurer, contractors, homes and people are invented; the documents, the sequence and the law are real.

One storm, three clocks: the contractor's, the solution's, and a desk working by hand

The contractordays 1–14
Crestline: 23 estimatesdays 1–7
Northgate: 17 estimatesdays 8–14
  • Crestline: 23 estimatesdays 1–7
  • Northgate: 17 estimatesdays 8–14
With Contractor Fraud Detectionhold on day 17
Copies repeat, cluster growsdays 1–14
Names joined, hold signedday 17
Re-inspections19–21
Referral prepareddue day 47
  • Copies repeat, cluster growsdays 1–14
  • Names joined, hold signedday 17
  • Re-inspections19–21
  • Referral prepareddue day 47
By hand (our estimate)about 46 days
Noticing estimates repeat30 d
Listing claims5 d
Linking names5 d
Hail, referral6 d
  • Noticing estimates repeat30 d
  • Listing claims5 d
  • Linking names5 d
  • Hail, referral6 d
Fictional sample storm: hail on Fri 25 Sep 2026 (day 0); the hold was signed on Mon 12 Oct (day 17), a target the solution is designed for, not a measured result; the Texas fraud-unit referral is due 30 days from the suspicion. The bottom lane is our estimate of the days an SIU spends finding the same cluster by hand, by which time the queued payments have gone out.Source: Tex. Ins. Code §701.051

How do roofing scams work after a storm? Door, form, copy, new name

Roofing scams after a storm follow a recognisable sequence. Canvassers work the streets in the first days; in the sample storm the first forms were signed the day after the hail. The pitch is a free inspection and help with the insurance claim; the paperwork is a contract and a direction-to-pay form; sometimes there is an offer to cover the deductible. Then come the estimates, written from one template with quantities pasted rather than measured. If an adjuster asks questions, the business can file a new name and carry on. Texas regulators list the homeowner's side of the same playbook: contracts with blank sections, contracts that hand over "every penny" of the insurance payment, requests for large payments up front and offers to waive the deductible or "work it into the bid" (TDI).

None of those steps is hidden from the insurer. The forms, estimates and business names all arrive in claim files. They arrive in different files, on different desks, over two weeks, which is why the scam works.

Days 0 to 2: the hail, the door and the form

Hail up to 2.75 inches fell across Collin County between 17:40 and 19:15 on Friday 25 September. The next day, Crestline Storm Restoration's first direction-to-pay forms were signed at front doors. On Sunday 27 September Ellen and Mark Ostrowski signed one for their one-storey house at 1418 Cedar Brake Lane, McKinney, and Crestline's estimate CSR-0927-14 followed: 34 lines, $30,912.40, prepared by J. Vance.

Nothing about the Ostrowski claim alone says scam. The radar estimate at the house was 0.75 inches, under the insurer's 1.00 inch setting for re-inspecting a roof replacement first, but hail of that size fell nearby and roofs vary. The estimate billed 34.67 squares on a roof the aerial report measured at 23.6, with steep and high-roof charges on a 5/12, one-storey roof; a careful desk adjuster might query it, as one later did on another house. Two homeowners told that adjuster by phone that the roofer had offered to cover their deductible, which in Texas is an offence under Business and Commerce Code §27.02.

What is a cluster of claims? Day 3, when the copies first repeat

A cluster of claims is a group of claims whose contractor documents are alike enough that they were probably written once and reused: the same lines, the same quantities, the same notes, on different houses. In the sample storm the copies were visible from the third day, when Crestline's estimates began to repeat line for line; by the end of its first week the contractor had filed 23 of them, each billing 34.67 squares of tear-off.

"Visible" is the key word. The fingerprinter compares each new estimate with every earlier one as it arrives, so the group grows on the screen day by day. By week two the weekly report listed the cluster at 23 homes, and on Friday 9 October it was on the contractor watch list. The decision to hold came on day 17, after the identity linker had joined the second business name to the first and the payment guard had found payments queued for the next morning. How the comparison tells a copy from a firm's own template is set out in insurance estimate comparison across claims.

Days 6 and 7: the question, and a new name

On Thursday 1 October the desk adjuster questioned a Crestline estimate billing 34.67 squares on a roof that measured 26.0. On Friday 2 October an assumed name, Northgate Roofing & Exteriors, was filed, and Crestline's estimates stopped. From 3 to 9 October, 17 Northgate estimates arrived: the same 34 lines, the same quantities, the same two typos, the same phone, PO box, bank account, estimator and rep signature.

A name change is cheap. In Texas an unincorporated business files an assumed name with the county clerk and a company files with the Secretary of State, and both offices keep public indexes (Tex. Bus. & Com. Code ch. 71). What a new name does not change are the values printed on the documents already in the insurer's files. The identity linker joined the two names on Monday 12 October at 06:12, on five such values, each from a document, and the business filings showed that Crestline was an Oklahoma company formed in March 2025 with no Texas office.

The watch list in Contractor Fraud Detection: Crestline, now with its second name

A contractor watch list with nine contractors whose estimates crossed the similarity line in this storm or an earlier one. Crestline Storm Restoration, also Northgate Roofing and Exteriors, roofing, Collin County hail and Norman hail, 51 homes, strongest evidence the same 34-line estimate on 40 homes and 5 identity links, status referral drafted. Ironbridge Exteriors, the same test-square photo on 6 roofs, rotated, investigating. Caprock Restoration, the same 30 lines on homes 2 to 4 miles outside the damaging hail, new. Bluebonnet Tree and Debris, one $8,940 invoice on 17 homes, 5 with no tree on the roof. DryRight Mitigation, the same moisture readings to the decimal in rooms of different sizes. Halcyon Roofing Partners at 0.83 alike, under the line, watching. Two contractors cleared after re-inspections and crew logs matched.
Fictional sample storm. Crestline's earlier appearance, after a May 2026 hailstorm in Norman, Oklahoma, is on the same row: 11 claims, four re-inspected, three with no hail damage.

Day 17: how insurers stop payments to scam roofers, and what the hold changed

Insurers stop payments to a scam roofer by deciding, before the payment run, to re-inspect the unpaid claims and pay what the re-inspection finds. On the morning of Monday 12 October, the solution's run listed the cluster's forty claims for the SIU manager. Thirty-one were unpaid, with $960,468.40 billed; four of them had payments queued for the next day's run, $92,420, with no acceptance letters sent. Nine had been paid at actual cash value, $214,380, with $58,740 of depreciation still withheld.

What Contractor Fraud Detection found still protectable on day 17, in one cluster

$1,019,208

not yet paid: unpaid estimates plus withheld depreciation

$92,420

in four payments queued for the next morning, pulled

31

claims held for re-inspection, with a letter to each insured

9

claims already paid, sent to recovery review

Fictional sample cluster C-07 in Contractor Fraud Detection: 40 claims, two business names, $1,240,864 billed.

The SIU manager signed one hold for the 31 unpaid claims and sent it to the catastrophe claims manager to co-sign, as the insurer's settings require for holds on more than ten claims. Re-inspections were booked for 14 to 16 October. Thirty-one letters were drafted to the insureds, not to the contractor, to go out on co-signature, saying the roof would be re-inspected before the claim was decided and that the claim was not denied. In Texas an insurer that needs more time must tell the claimant the reasons within the decision period (Tex. Ins. Code §542.056(d)); what such a hold needs to survive review is the subject of hail damage insurance fraud: a payment hold that survives review.

The hold changed where the money went. Paid claims can only be recovered, which after a contractor scheme usually means a lawsuit against a business that may have changed its name again. Unpaid claims can be paid at the measured size of each roof, to the homeowner's actual damage, with the deductible the homeowner owes. For the nine claims already paid, the withheld depreciation is the part still in the insurer's hands.

Day 17: forty claims, each with its roof, its hail, its payment and its deadline

The cluster's claims table: 31 unpaid billed $960,468.40, 4 payments queued for Tue 13 Oct totalling $92,420 with no acceptance letter sent, 9 paid at actual cash value $214,380 with $58,740 depreciation held, $1,019,208 not yet paid. Rows show each claim with the name on the estimate, roof measured against billed such as 23.6 / 34.67, storeys and pitch, hail at the home, payment status, prompt-pay date and recommendation: hold and re-inspect, or recovery review for claims already paid.
Fictional sample data. The payment guard recommends; the SIU manager decides each hold.

Where such schemes are usually found: months later, in a payments audit

Without a cross-claim view, a contractor pattern is usually found after payment, when an analyst reviewing a contractor's paid claims, or a call from another insurer, connects the names. By our estimate the steps take an SIU about 46 days on a cluster like this one, 30 of them spent simply noticing that estimates repeat. In the sample storm, 46 days after the hail is 10 November: the queued payments would have gone on 13 October and the unpaid claims would have been paid as their deadlines came due.

Real cases show how long a scheme can run unnoticed. The Ohio roofing case involved at least 80 inflated invoices over about two years (S.D. Ohio); the Washington restoration owner began inflating estimates "as early as 2004" and was sentenced in 2010 (W.D. Wash.).

What happens when a roofer commits insurance fraud?

The roofer can face state charges graded by the value of the fraud, restitution and, in federal schemes, prison; the insurer, meanwhile, must report it. Texas grades insurance fraud by the value of the claim, aggregates claims made in one scheme, and requires the court to order a convicted defendant "to pay restitution, including court costs and attorney's fees, to an affected insurer" (Tex. Penal Code §§35.02–35.03). Anyone who determines or reasonably suspects a fraudulent insurance act must report it to the Department of Insurance's fraud unit within 30 days (Tex. Ins. Code §701.051); in the sample, the referral the fraud analyst completes is due on Wednesday 11 November, with 40 estimates, 40 forms, 5 link documents and 3 re-inspections attached.

How four real contractor cases ended

CaseWhat they didOutcome
North Carolina, 2025–26Roofing company employees damaged shingles on a home and claimed wind and hailGuilty pleas; one sentenced to 24 months’ supervised probation and barred from roofing during it; $27,678.50 restitution paid by the other
Ohio, 2014Roofing company sent insurers at least 80 inflated duplicate invoicesOwner pleaded guilty; plea agreement range of 24 to 57 months
Washington, 2010Restoration company padded sub-contractor bills and forged competing estimatesFour years in prison and $4.9 million restitution
Florida, 2026After Hurricane Ian, an unlicensed man posed as a contractor to an elderly homeownerFour years in federal prison; forfeiture order of $1,261,019
From the North Carolina Department of Insurance and U.S. Attorneys' releases cited on this page. The Florida case defrauded a homeowner rather than an insurer.Source: NCDOI, Aug 2026; S.D. Ohio; W.D. Wash.; M.D. Fla., Jul 2026

What are signs of a roofing scam? For homeowners, and for the adjuster

The signs are different on each side of the claim, and both lists come from the same storm. Homeowners see the pitch; adjusters see the paperwork.

Signs of a roofing scam after a storm

  1. A request to sign before anyone goes on the roof

    TDI warns that some contractors call a contract an estimate or a release.

  2. Blank spaces, or “the value of the insurance proceeds”

    Texas regulators tell homeowners never to sign either.

  3. A large payment up front

    After a declared disaster in Texas, an out-of-area remediation contractor may not require any payment before work begins.

  4. An offer about the deductible

    Illegal in Texas and Florida, and grounds in Colorado, Minnesota and Oklahoma for the insurer to disregard the estimate.

  5. For adjusters: forms signed in the first 72 hours by one rep on many homes

    From the sample storm’s weekly report.

  6. For adjusters: the same squares and drip edge on homes of different sizes

    Measured against billed is the plainest sign the quantities were pasted.

  7. For adjusters: steep or high-roof charges on one-storey, low-pitch homes

    Lines that were not written for the house.

Homeowner signs from the Texas Department of Insurance and Tex. Bus. & Com. Code ch. 58; adjuster signs from the weekly report in the fictional sample storm.Source: TDI; Tex. Bus. & Com. Code ch. 58

What should homeowners do after signing with a storm chaser?

A homeowner who has already signed should read what was signed, tell the insurer, and use any cancellation right the state gives. Florida lets a homeowner cancel a roof contract signed within 180 days of a declared emergency within 10 days or by the official start date, whichever comes first (Fla. Stat. §489.147(6)). Colorado lets a homeowner rescind within 72 hours of the insurer's written notice that the roof claim is denied in whole or in part (C.R.S. 6-22-104). Minnesota lets a homeowner cancel a post-loss assignment to a residential contractor within ten business days (Minn. Stat. 325E.67). In Texas, after a declared disaster, an out-of-area remediation contractor may not require payment before work starts (ch. 58).

This is general information, not legal advice. The insurer's re-inspection protects the homeowner too: in the sample storm, the letters said the claim was not denied, and the roof would be paid at what the re-inspection found. What the law says about deductible offers in each state is set out in is it illegal for a roofer to pay your deductible.

Questions people ask

How many claims can one storm chaser file?

As many as it can sign. In the sample storm one contractor filed 40 copied estimates in 14 days under two business names, and had filed 11 claims after an earlier storm in Oklahoma; in a real Ohio case, at least 80 inflated invoices went to insurers over about two years.

How do insurers catch roofing scams?

By comparing contractor estimates across claims, measuring roofs independently, re-inspecting before payment and sharing evidence with state fraud units. In the sample storm, the cluster was visible from day 3 and held on day 17, before the payment run.

Will my claim be denied if my roofer was running a scam?

Not for that reason alone: the claim for real storm damage is yours. In the sample storm the insurer re-inspected the roofs and wrote to each insured that the claim was not denied; payment follows what the re-inspection finds.

Can the insurer refuse to pay the roofer?

It can decline to pay an estimate that does not match the house and pay what the covered damage costs. In Colorado, Minnesota and Oklahoma it need not consider at all the estimate of a roofer who advertised or promised to pay the deductible.

Who do I report a roofing scam to?

Your insurer, and the state: in Texas, the Department of Insurance's fraud unit for insurance fraud and the attorney general for deductible offers; in Florida, the Department of Financial Services' Division of Criminal Investigations.

Contractor Fraud Detection.
See it on your own files.

An agentic solution from Botminds. After a storm, agents watch every new claim for the same contractors, the same estimates and the same signatures, and raise the cluster before payment. Book a demo, or explore how it works.