Document fraud investigation process: four seats, one altered invoice

The document fraud investigation process in an insurance claim runs through four seats held by four people. The adjuster notices that an invoice, bill, estimate or receipt does not hold up and stops the money. The bill reviewer prices and codes medical and repair bills. The special investigations unit (SIU) investigator decides whether the facts support a fraud referral and builds the file. The fraud manager answers to the state for what was reported and how. The hard part is the first seat: an edit that changes one figure leaves the page looking clean, and nobody examines a document they have no reason to doubt. Document Fraud Detection is Botminds' solution for that first step. Six agents test every claim document over a set amount before it is paid and pin each finding where it sits on the page, and the four people make every decision.

This guide follows one invoice through all four seats. It is sample data on fictional people and companies: a $9,812.60 water-mitigation invoice from Clearwater Dry-Out & Restoration LLC, uploaded to a homeowners claim at a fictional carrier, Larkspur Mutual, at 08:12 on Monday 12 October. By 09:21 it was an SIU case covering five claims. The interesting part is not the speed. It is who decided what, on what evidence, and what each seat would have missed on its own.

What is the document fraud investigation process? Four questions, asked in order

The process is a relay of four questions, and each seat owns one. The adjuster asks whether to pay. The bill reviewer asks what, specifically, is wrong with the bill. The investigator asks who made the document and whether the facts prove intent. The fraud manager asks whether the company met its duties to detect, refer and report. A document fails the process when it slips past the first question, because the other three seats only see what the first one sends them.

Regulators write the first seat into the rules. California makes claims staff, which it calls integral anti-fraud personnel, responsible for spotting suspected fraud and referring it to the SIU as part of their regular duties, and requires the SIU to give them written red flags specific to each line of insurance (10 CCR § 2698.35). The NAIC's model antifraud plan guideline treats doctored receipts, estimates and medical billings as suspected fraud whether or not the claim has been paid (GL-1690). The rule is settled. What fails is the routing: getting a finding from the page to the person who can act on it, in time, with enough evidence that the next seat does not have to start again.

Who checks invoices on an insurance claim? Mostly the adjuster, between other work

On most property and auto claims the adjuster is the only person who reads the invoice before it is paid. That makes the adjuster the de facto document examiner, without the time or tools to be one. A proper check means four separate jobs: redo the arithmetic, look at the file itself, confirm the vendor exists and is who it says, and compare the document with others like it. Each one is easy. Together they are a small investigation, and the adjuster has dozens of other files open.

There is also a limit on how hard an adjuster may push. California requires every insurer to investigate thoroughly, fairly and objectively, and forbids it to keep asking for information the claim dispute does not reasonably need (§ 2695.7(d)). Asking every claimant for originals, bank statements and vendor confirmations is not diligence. It is a complaint waiting to happen. The adjuster needs to know which documents deserve the extra question, and why, before asking it.

That is the seat the solution changes most. Since 06:00 on the sample Monday, the agents had tested 186 claim documents before anyone could pay on them, averaging 38 seconds each: 171 passed, 12 raised a question and 3 were refer-level. Marisol Quintero, the fictional senior property adjuster, opened the Clearwater invoice one minute after it arrived and found six numbered pins on the page.

The adjuster's view: six findings pinned where they sit on the invoice

Each pin names its test, its level and its measurement. The total, "$9,812.60", is set in Arial Bold at a 2.3 px stroke while every other figure on the page is Inter at 1.7 px. The nine lines add to $4,812.60, which is the printed subtotal; with $0.00 tax, the total should be $4,812.60, not $9,812.60. The file was made by an online invoicing app on 22 September and saved again in a desktop PDF editor on 11 October at 21:47, ten hours before it was uploaded. How to look for those traces by hand is set out in how to check if a PDF has been altered.

What does a bill reviewer do, and what does the review miss?

A bill reviewer checks whether a medical or repair bill is priced and coded correctly: the procedure codes, the fee schedule or usual charge, the units, and whether the treatment or repair matches what was approved. It is a pricing discipline, and it is good at what it looks for. Florida's personal injury protection statute shows its reach: an insurer need not pay for treatment that is "upcoded, or that is unbundled when such treatment or services should be bundled", and may re-code the bill and pay on the corrected codes (§ 627.736(5)(b)).

What the coding review does not look for is a page that was edited after it was produced. A bill with the right codes and the right prices can still carry a date of service typed in later. In June 2026 North Carolina's Department of Insurance charged two people over a crash claim, accusing one of submitting an altered chiropractic invoice for services not provided on that date and obtaining a $4,500 settlement, and the other of submitting two altered massage-therapy invoices and obtaining $9,005 (NCDOI; charges, not convictions). Nothing in those allegations would trip a coding edit. The dates were the lie.

In the sample the bill reviewer, Henry Tsai, sees both views. Every medical bill over $500 is tested for edits as well as coded. One orthopedic bill shows three dates of service on a second text layer added after the bill was produced. The coding may be perfect; the question for the provider is about the dates. For how a medical line travels from a demand letter to the bill behind it, see medical specials, traced line by line.

When does an altered invoice go to the SIU?

An altered invoice goes to the SIU when the facts create a reasonable belief that someone may have committed insurance fraud, not when fraud is proven. California puts it in exactly those terms and asks each referral to say whether the investigation is complete or more is needed (10 CCR § 2698.37). A changed total, a vendor with someone else's tax ID and a template seen on other claims are each a red flag. Together they are a referral.

The referral form tells the adjuster what to send. California's regulation lists the money split a document test produces, from the total potential loss before fraud was identified to the amount actually paid on the suspect item, and asks for a summary that includes "What documentation there is of the alleged misrepresentation." (10 CCR § 2698.38(d)). Then the clock starts. California expects the referral to its Fraud Division within 60 days of the determination (FD-1); Texas and New York each set 30 days (§ 701.051, § 405). The clocks are compared state by state in insurance fraud reporting requirements by state.

Who decides if a document is fraudulent? A court, eventually, and never one person alone

Nobody in the claim department decides that a document is fraudulent. Fraud is a finding about intent: Florida's statute, typical of the states, covers a written statement made "with the intent to injure, defraud, or deceive any insurer" (§ 817.234). The adjuster decides whether to pay. The SIU decides whether the evidence supports a report. A prosecutor decides whether to charge, and a court decides the rest. A document test can only establish facts: this figure was added later, these sums do not agree, this tax ID belongs to another business.

That is why the agents in the solution stop at facts. File forensics reports evidence with measurements and never calls a document fraudulent. The referral says so in its signature line: "Your signature confirms the facts above; it does not accuse anyone." Any refer-level finding gives a Refer verdict, and the same evidence always gives the same verdict, so an adjuster cannot be talked out of a finding and an agent cannot invent one.

The second rule is that no single person can wave a refer through. Paying against a refer needs a second approval from the fraud manager. The reason is not theoretical. In October 2026 New Jersey's Attorney General announced an indictment alleging that a homeowners insurer's field claims examiner, on fabricated mitigation and restoration invoices, "reassigned the claims to himself" and approved about $108,000 in payments for work never performed, taking about 20 percent (NJ OAG; the family is charged, and the examiner pleaded guilty in May 2026). The NAIC guideline asks every antifraud plan to describe the insurer's "corporate policies for preventing, detecting and investigating suspected internal fraud committed by company employees, consultants or others, such as underwriters, claims representatives, appointed agents, etc." (GL-1690). A test that runs on every document, whoever handles the claim, is one such policy.

"An insurance claim should be paid because it is legitimate, not because the person approving it stands to receive a share of the proceeds."

New Jersey's Acting Insurance Fraud Prosecutor, announcing the October 2026 indictment

One altered invoice, 08:12 to 09:21: where the hour went

The agents' share of the hour was 41 seconds. The rest was people reading, deciding and signing, which is where it should be. The adjuster spent most of an hour with the evidence before she signed, which is about right for a referral that names four other businesses on four other claims. The SIU accepted the case a quarter of an hour after it arrived.

Inside the 41 seconds, two steps carry most of the time: file forensics, which measures every glyph and layer, and the look-alike search across past claim documents. The search is the step no adjuster could do by hand at all. It found the same invoice template on four unrelated claims under four other business names, handled by three other adjusters, with $19,150.00 already paid on two of them.

The fraud manager's seat in Document Fraud Detection: thresholds, versions, the state

The fraud manager owns the rules, and that ownership has to be visible to an examiner. The NAIC guideline asks antifraud plans to describe the detection technology and procedures, the criteria for referring claims to the SIU, and how referrals and their outcomes are tracked (GL-1690). A detection rule nobody can date or explain is a weak answer to any of those.

In the sample, Grace Nwosu, the fictional fraud manager, sets which documents are tested: any claim document over $1,000, every medical bill over $500 (raised from $250 on 5 October), and every document on a claim already flagged. She sets how hard each test bites: ink weight, arithmetic and look-alikes are refer-level; text layers, edit history, baseline, claim facts and the vendor register raise a question. Each change is published as a new version and applies only to documents received after it. The design target is that every claim document over $1,000 is tested before payment.

The fraud manager's rules, each one dated and versioned

The counts matter for calibration. Over 30 days the sample carrier tested 4,972 documents: 4,511 passed, 389 raised a question and 72 were refer-level. A manager who sees a test firing hundreds of times can ask whether it is finding fraud or finding a vendor's habit, and change its level with a dated version instead of an email.

What should a document fraud file note include?

A document fraud file note should state facts an outsider can check, say where on the page each fact sits, and say what was and was not done. It should not accuse anyone. The note is read by the SIU, possibly by the state fraud bureau, and, if the claim is litigated, by the claimant's lawyer. Every sentence needs to survive all three.

The Clearwater referral is built that way. Under "What we found" each sentence ends in a pin number. Under "What we have done" it says the payment on the claim is held and that no one has contacted the insureds or the vendor. Under "What we ask" it asks the SIU to open one case for five claims, decide whether the two open invoices should be paid, and decide whether a report to the state fraud bureau is due.

One referral, five claims, every sentence cited

How do insurers verify receipts and invoices without tipping off the claimant?

Insurers verify documents against sources the claimant does not control: the vendor register, a state contractor registration, the claim's own dates, the regional price list, and past claim documents. A call to the vendor comes later, and a request for an original document asks for the document without saying why. California does not require an insurer to disclose anything that could alert a claimant that a claim is being investigated as possibly fraudulent, and lets it take longer to decide such a claim (10 CCR § 2695.7).

The Clearwater checks show how far independent sources go. The business was not on the carrier's vendor register and had no state contractor registration under its name. Its EIN was on a different business's invoice already paid on another claim. Unit 4 at its address is a mailbox store, the phone is a prepaid mobile activated in June, and its remit-to PO box appears on three other invoices. The insureds and the work dates did match the claim, which the note also says, because a finding that leaves out what matched is not a fair one. A family of invoices like this one is the subject of duplicate invoice detection software and the copy with a new name.

Questions people ask

What happens when an insurer finds a fake invoice?

The adjuster holds the payment on that item and refers the claim to the SIU, which decides whether to investigate and whether to report to the state. California expects a referral to its Fraud Division within 60 days of the determination; Texas and New York set 30 days. Prosecution, restitution and any recovery come later and are decided by others.

Can an insurer deny a claim because of one altered invoice?

An insurer can refuse to pay the altered item and investigate the rest. Florida's PIP statute, for example, says an insurer need not pay charges to a person who knowingly submits a false or misleading statement relating to the claim. Whether the whole claim fails depends on the policy's fraud condition and state law, which is a coverage question for the claims and legal teams.

Does the insured get told the claim is under investigation?

Not necessarily. California's claims regulation does not require an insurer to disclose information that could alert a claimant to a fraud investigation, and the sample solution never contacts the insured or vendor about a finding. Some states require notice on specific lines; Florida PIP, for instance, requires written notice within 30 days when the insurer has a reasonable belief of fraud.

Who reports suspected fraud to the state?

The insurer does, usually through its SIU, and the antifraud plan names the person or position responsible. The NAIC's guideline asks the plan to state which individual or group reports on the insurer's behalf and the criteria for reporting. The adjuster's signed referral is the start of that record.

Can an edited invoice be innocent?

Yes. Vendors correct typos, re-issue invoices and add a claim number after the fact. That is why an edit-history finding raises a question rather than a refer on its own, and why the note records what matched as well as what did not. In the sample, a pharmacy receipt cluster was closed after a printer change was confirmed.

Do bill reviewers check for fraud?

Bill reviewers check pricing, coding and whether a bill matches the approved treatment or repair. Fraud in the document itself, such as a changed date of service, usually needs a separate test of the file, which is why the sample tests every medical bill over $500 for edits as well.