Insurance fraud analyst: the seat that sees the ring first

An insurance fraud analyst is the person in a special investigations unit (SIU) who looks across claims instead of into one: they search the claim system for the phone, address, clinic or attorney that keeps coming back, decide which shared details are coincidence and which are a pattern, and hand the investigator a group of claims worth working. Adjusters see one file at a time and investigators work one case at a time, so organized rings, which reuse the same people and providers across many policies, are visible only from the analyst's seat. Botminds' Fraud Network Analysis is a link analysis solution built for that seat: its agents read every claim file, match the same person written different ways and draw the rings each night, and the analyst decides how links are weighed, what counts as noise and which uncertain matches are real.

The examples on this page come from a fictional sample carrier, Keywater Insurance Company, and its South Florida SIU, as they run in the solution; the people, clinics, phones and claims are invented. The research figures come from regulators, the Bureau of Labor Statistics and peer-reviewed studies, linked where they appear.

What does an insurance fraud analyst do?

An insurance fraud analyst finds the patterns that single claims hide, and turns them into work an investigator can act on. In practice that means four jobs: searching across claims for shared identifiers, deciding whether two records are the same person or business, judging whether a group of claims shares more than chance would explain, and writing that judgement down so a manager can approve it.

The federal occupational database puts the job in a family called Fraud Examiners, Investigators and Analysts, and lists "Fraud Analyst" and "SIU Field Investigator" among the job titles reported for it. Its task list reads like an analyst's week: study billing trends and financial relationships for irregularities, screen reports of suspected fraud to decide which need investigating, and build and maintain the tools and procedures that detect it (O*NET OnLine, 13-2099.04).

The third of those is the one outsiders miss. In most SIUs the analyst owns the rules: which red flags generate a referral, which links count, and when a cluster is big enough to look at. That makes the analyst the person who answers when a model flags the wrong people, and the person who notices when a scheme has moved on to a pattern the rules do not yet see.

How is a fraud analyst different from an SIU investigator?

An SIU investigator works a case; a fraud analyst works the population of claims the cases come from. The investigator interviews, takes recorded statements, runs examinations under oath and writes the referral. The analyst rarely meets a claimant. Their output is a list, a chart or a cluster that says where to look and why.

The Bureau of Labor Statistics describes the investigator's side of that span in one line: "The severity of insurance fraud cases varies, from overstated claims of vehicle damage to complicated fraud rings" (BLS Occupational Outlook Handbook). The first kind is a claim problem and an adjuster or investigator can see it in one file. The second kind is a network problem, and nobody sees it unless someone is looking across files.

Regulation keeps the seats apart in some states. New York's Regulation 95 requires carriers writing at least 3,000 auto, workers' compensation or accident and health policies a year to run a full-time SIU separate from claims and underwriting, with staffing justified by an assessment of the caseload an investigator can handle (11 NYCRR 86.6), and designated SIU investigators must meet the education or experience criteria the regulation sets (NY DFS, 2025 health insurance fraud report). No comparable rule names the analyst, which is part of why the seat is easy to overlook in a staffing plan.

Why rings are only visible from the analyst's seat

Rings are built to look ordinary one claim at a time, so the only place they look unusual is in aggregate. California's Department of Insurance describes the cast: "Staged collisions are orchestrated by organized rings of criminals and involve the collision participants, stagers, cappers, attorneys, doctors, chiropractors, body shops and others" (CDI, Automobile Fraud). Each of those parties appears on a different document in a different claim. The adjuster sees a passenger, a clinic bill and a letter of representation. Only someone holding all the claims sees that the same clinic, the same law firm and the same callback number recur.

The research says the same thing in numbers. A study by researchers at KU Leuven of a couple of million claims from one insurer, which linked every claim to its policyholders, brokers, experts and garages, found that models built from those network features beat models built from claim-level features alone, and that combining the two did better still. It also shows how thin the ground truth is: in that data, under one percent of claims a year went through a formal fraud investigation, and fewer than half of those ended with a known fraud label (Óskarsdóttir et al., 2020). An analyst works in that gap, between millions of unlabelled claims and the handful anyone has had time to investigate.

Carriers know this. In the NAIC's survey of homeowners insurers, 26 companies reported using AI or machine learning to detect organized crime rings and 24 reported using social network data, while most of the models used to refer claims for investigation helped a person decide rather than deciding themselves (NAIC Big Data and AI Working Group, homeowners survey memo). Helped, not replaced: the decision about what the network means still sits with a person, and in most SIUs that person is the analyst.

What the analyst decides that no model should

The analyst decides what counts as a link, what counts as noise, and which near-matches are the same person. Those three calls set everything downstream: how many rings the investigators see, how many innocent providers get pulled into one, and how much the SIU manager can trust a chart.

The noise problem is the hardest. Busy professionals touch thousands of honest claims. A study of Italy's national antifraud archive found roughly 4,000 subjects involved in more than 100 accidents each and a small number in more than 50,000, and identified them: "They are lawyers, insurance adjusters, physicians and all those actors who were not directly involved in the accident" (Tumminello et al., Journal of Risk and Insurance, 2023). The same authors warn that dropping such hubs outright is dangerous, because some of those professionals sit at the centre of real rings (the tow truck guide shows how to test such a hub). Choosing which hubs to set aside, and which to keep and test, is a judgement, and it belongs to the analyst. The innocent hub problem is worked through on a tow yard elsewhere in this series.

The analyst's controls in Fraud Network Analysis

In the sample unit the analyst, Theo Lindqvist, has weighted a shared bank account at 1.00 and a shared tow yard at 0.30, set aside 37 hubs, and asked for any group of four or more claims scoring 70 to be drawn as a ring. None of those numbers is right in general. A unit in a dense city may need a lower weight on addresses, because apartment buildings link strangers; a unit with a theft problem may weight payout accounts above everything. What matters is that the weights are written down, versioned and approved, so an investigator can ask why a ring was drawn and get an answer.

Where the analyst's days go on one ring

On a ring of about ten claims, most of the analyst's time by hand goes to finding and reading, not to judging. Botminds' own estimate for one such ring puts it at about 18 working days by hand, of which pulling claim lists, searching identifiers one at a time and drawing the chart take ten.

The shift is in what is left. With the searching and drawing done overnight, the remaining time is the part that needs a person: reading the intake form behind a link, deciding whether the shared address is a household or a ring, and checking the drafted lead line by line. The entity resolution step, where "Javier Ruiz", "J. Ruiz" and "Jay" become one caller, is the analyst's other daily task, and the one most worth automating carefully.

What skills and tools does an insurance fraud analyst need?

A fraud analyst needs three kinds of skill: reading claim documents the way an adjuster does, querying data the way an analyst does, and judging evidence the way an investigator does. Most postings ask for a degree; the federal occupational survey found 83% of respondents said a bachelor's degree is required for this family of jobs, and listed SQL, Python, R, Tableau, Excel and Visio among the tools in use (O*NET OnLine).

The tools matter less than three habits. The first is source discipline: every link on a chart should point to the page it came from, because an investigator will be asked about it under oath. The second is base-rate thinking: two claims sharing an address is common; four claims sharing an address, a clinic and a callback number within six months is not. The third is writing in "linked to" language. An analyst's chart is a reason to look, not a finding, and a referral that reads like an accusation is harder to defend if the investigation clears the people in it.

Domain knowledge rounds it out. An auto analyst needs to know how personal injury protection is billed in their states, what a letter of representation changes, and which state fraud bureau gets a referral on which clock. The staged accident indicators that only show up across claims are the analyst's working vocabulary.

How much does an insurance fraud analyst make?

There is no federal wage line for "insurance fraud analyst", so pay has to be read from the two occupations that contain the job. The Bureau of Labor Statistics puts the median for claims adjusters, examiners and investigators, the group that includes insurance investigators, at $78,000 in May 2025, and at $79,280 inside direct insurance carriers other than life and health. O*NET reports a 2025 median of $81,100 for the broader financial-specialist category it uses for fraud examiners, investigators and analysts.

The spread inside the claims group is wide: the lowest tenth earned under $48,850 and the highest tenth over $117,040. Analysts with data skills tend to sit toward the upper end, and the private investigators some carriers contract for field work sit well below: BLS puts the median for private detectives and investigators at $51,220 (BLS, private detectives and investigators).

How do I become an insurance fraud analyst?

Most fraud analysts arrive by one of two roads: from claims, where they learned how files are built and paid, or from data work, where they learned to query and model. The first group knows what a clinic intake form should look like; the second knows how to find the 40 claims that share one. Units that hire both, and pair them, tend to build better rules than units that hire only one.

The outlook favours the analytical road. BLS projects employment across claims adjusters, appraisers, examiners and investigators to fall 6% from 2025 to 2035, and says technology is expected to automate some of the tasks these workers perform, with artificial intelligence named, while still projecting about 21,600 openings a year. The work that shrinks is the searching and copying; the work that remains is the judgement about what the searches found.

For someone already in a claims role, the practical route is to become the person in the unit who looks across files: volunteer for the referral reviews, learn the SIU's red flags for your line, and learn enough SQL to answer "who else uses this phone?" without waiting for a report. Banking runs a parallel version of the job, with its own day and its own data; a day in the life of a fraud analyst at a bank shows the contrast.

What changes in the seat with Fraud Network Analysis, and what does not

Fraud Network Analysis takes over the mechanical half of the analyst's job and leaves the judgement half alone. Six agents read the first-notice call logs, PIP applications, intake forms, bills, letters of representation, tow invoices and payment records; match names written different ways; rebuild the link map each night over a 24-month look-back; and draw groups of claims that score above the analyst's threshold. The analyst's morning starts with those rings and with the name matches the agents were not sure of.

One phone, selected: the work the analyst used to do by hand

What does not change is who decides. The agents never call a ring fraud, never hold a payment and never contact anyone. A name match between 0.75 and 0.92 waits for the analyst, and two different dates of birth never merge. Rule and weight changes need the analyst and the SIU manager, and the investigator decides what becomes a lead. The researchers who built one of the first network systems for auto fraud put the principle plainly: "Final assessment of potential fraud can only be made by the domain expert or investigator, who also determines further actions in resolving it" (Šubelj, Furlan and Bajec, 2011).

The analyst's measure of success shifts too. When the drawing is free, the questions become whether the rings the agents draw survive investigation, and whether the hubs set aside were the right ones. Five tests a detected ring must pass sets out how to measure that, and Fraud Network Analysis shows the seat end to end.

Questions people ask

Do fraud analysts work cases?

Usually not in the investigator's sense. The analyst builds the picture that starts a case, a ranked group of claims and the links between them, and supports the investigator with searches as it develops. In small SIUs one person may do both, but the work is different: one looks across the book, the other proves what happened on specific claims.

What does a fraud analyst report on?

Typically on referrals generated, rings or clusters found and their outcome after investigation, and the money tied to them. A useful analyst report also shows the rules that fired, the false leads cleared and why, and the hubs set aside, so the SIU manager can see whether the rules are finding real schemes or just busy providers.

What tools do fraud analysts use?

O*NET lists database query tools such as SQL, programming languages such as Python and R, business intelligence tools such as Tableau, and spreadsheets among the software reported for fraud examiners, investigators and analysts. Analysts working rings also use link charting or graph tools, and the claim system's own search, which is where most hand searching still happens.

Will AI replace insurance fraud analysts?

The evidence points to a narrower seat, not an empty one. BLS projects a 6% decline across claims adjusters, examiners and investigators from 2025 to 2035 and expects technology, including AI, to automate some of the tasks, but insurers in the NAIC's surveys report that their fraud referral models mostly augment human decisions. The searching shrinks; the judgement about hubs, matches and what a ring means stays with a person.

Is an insurance fraud analyst the same as a fraud examiner?

The federal occupational classification groups them together as fraud examiners, investigators and analysts, with "Fraud Analyst" among the reported job titles. In insurance usage, an examiner more often means someone who investigates and documents a specific matter, and an analyst someone who works across data to find where to look.

How many claims does a fraud analyst look at?

All of them, in principle, and almost none by hand. The analyst's search runs across the whole look-back, which at the fictional sample carrier is 212,406 claims over 24 months, and the reading is confined to the few dozen claims that end up inside a ring. In the couple of million claims studied by Óskarsdóttir and colleagues, less than one percent a year went through a formal fraud investigation.