Link analysis software for investigations: what to test before buying

Link analysis software for investigations helps an investigator see how people, phones, addresses, businesses, accounts and events connect, by storing those entities and the relationships between them and drawing them as a network that can be searched and expanded. In an insurance special investigations unit it is used to find and prove organized fraud: the staged-accident ring, the clinic and runner network, the contractor who reappears after every storm. Before buying, test it on the work it will actually do: whether every line opens the document it came from, whether it reads the documents at all, how it matches names written different ways, how it handles hubs that link everyone, and whether its output becomes a lead a manager can sign. Botminds' Fraud Network Analysis is one answer to those questions, built as six agents around an SIU's claim files; the rubric below is meant to be applied to it and to every alternative.

Examples come from a fictional sample carrier, Keywater Insurance Company, and its South Florida SIU, as they run in the solution. The standards and research cited are linked where they appear.

What is link analysis software for investigations?

Link analysis software for investigations is any tool whose core output is a network of entities and their relationships, built for someone who has to act on it. The law-enforcement analytic standards describe the products it supports: a network analysis "might include an association matrix, a link chart, a map, a geospatial chart, a summary, conclusions, and recommendations" (Law Enforcement Analytic Standards, 2nd edition, 2012). The chart is one part of an argument, not the argument.

That matters for buyers because the same standards set the bar for the argument. "Analyses shall include alternative scenarios and avoid single-solution outcomes when appropriate," they say, and every product must separate what came from a source from what reflects the analyst's judgement. A tool that produces a confident picture with no sources and no alternatives makes that harder, however good it looks.

What is the difference between a link chart and a graph database?

A link chart is a picture of relationships someone has already found; a graph database is a store that can answer questions about relationships at scale. Neither reads a claim file. A third kind of product, agent-based link analysis, adds the reading, matching and ring-finding on top, and leaves the decisions to people.

Graph databases deserve a fair word. They are the right foundation for a data team that wants to build its own network analytics, and they scale to hundreds of millions of relationships. What they do not supply is the part an SIU lacks most: someone to read the documents, decide that "J. Ruiz" and "Jay" are one caller, and write the result down with sources. Buying a graph database for an SIU without that layer moves the bottleneck from drawing to data entry.

Can link analysis software find fraud rings automatically?

Yes, in the sense that software can find groups of claims that share more than they should; no, in the sense that only an investigation can say whether a group is a ring. The research is consistent on both halves. Network features help: a KU Leuven study found that models using features from the claims network beat models built on claim-level features alone (Óskarsdóttir et al., 2020). And a detected structure is not a finding.

Clearly, we are aware that a statistical anomaly cannot be considered a sentence of guilt.

Tumminello, Consiglio, Vassallo, Cesari and Farabullini, Journal of Risk and Insurance, 2023

That sentence comes from the team that built a ring detector for Italy's national antifraud archive, and it should be in every buyer's requirements. In Fraud Network Analysis the ring finder rebuilds the map nightly, sets aside hubs and scores groups of at least four claims, and it is built never to call a ring fraud, never to hold a payment and never to contact anyone. Each ring carries the reason it was drawn, in plain words: one first-notice phone on every claim, two clinics at one billing address, one attorney, one tow yard, new policies paid with one card. How to test whether those rings deserve trust is set out in five tests a detected ring must pass.

Asking Fraud Network Analysis a plain question, with every sentence sourced

Does link analysis software work with claims systems?

It should read from them and write nothing back that changes a claim. The useful integration is read-only access to claims, parties, payments and reserves, the document store where call logs, forms and letters live, billing and disbursement records, and the SIU's own watch list. The output should flow to the SIU's case process and to the state's reporting channel, not into the adjuster's decision.

The reporting end is worth checking explicitly. New York, for example, takes insurers' fraud reports through a web-based case management system: "The Department’s web-based case management system, known as the Fraud Case Management System (“FCMS”), allows insurers to electronically submit reports of suspected fraud" (NY DFS, 2025 health insurance fraud report). A tool that ends in a chart leaves the investigator to retype its contents into that report. One that ends in a lead with a dated timeline and numbered exhibits gives the referral its spine. State reporting rules are compared in insurance fraud reporting requirements by state.

Who uses link analysis software in an insurance SIU?

Five people use it, for five different things, and a good tool serves all of them without giving any of them powers they should not have. The fraud analyst sets what counts as a link and reviews uncertain matches. The investigator expands a claim, reads the sources and decides what becomes a lead. The SIU manager approves leads and referrals and owns the rules. The law-enforcement liaison packages approved referrals for the state fraud bureau and prosecutors, and wants a dated timeline and numbered exhibits. And the claim adjuster, who keeps paying what the law requires, needs an alert when a watched phone or clinic appears on a new claim, and nothing more.

Usage is spreading. In the NAIC's survey of homeowners insurers, 26 companies reported using AI or machine learning to detect organized crime rings, and most of the models used to refer claims for investigation supported a person's decision rather than replacing it (NAIC homeowners AI/ML survey memo). The NAIC's model bulletin on insurers' use of AI lists fraud detection among the uses it covers (NAIC Model Bulletin, 2023), so a buyer in a state that has adopted it should expect to document the tool like any other AI system.

What it must never do: the red lines

Link analysis software in an SIU should never decide, never act on a claim, and never let a line go unsourced. Those are not product preferences; they follow from how fraud law and evidence work. A referral to the state is protected by immunity provisions modelled on the NAIC's Insurance Fraud Prevention Model Act, which the model says does not apply to statements made with actual malice (NAIC Model Act #680); a chart that names people as suspects on the strength of a shared address is a poor foundation for that protection.

The evidence rules add one more. When a chart is offered in federal court to summarize voluminous records, "The proponent must make the underlying originals or duplicates available for examination or copying, or both, by other parties at a reasonable time and place" (Federal Rule of Evidence 1006(b)). Software that cannot produce the document behind each line leaves the investigator to rebuild the chart from scratch when a case reaches that point. How such a chart should read is covered in link analysis chart: how to read one, link by link.

How much does link analysis software cost?

Price is usually quoted per seat, per data volume or as a platform licence, but the number to compare is the total cost of producing one investigated ring, including the people. A charting tool is cheap to license and expensive to feed: every link is read and typed by an analyst. A solution that does the reading costs more to license and less to run.

The product's own planning estimate makes the comparison concrete. For one ring of about ten claims, Botminds estimates roughly 18 working days by hand, from pulling the claim files to the manager's referral, and about 2.8 days with the solution, with the investigator still checking every link at its source and manager review unchanged at one day. That is an estimate, not a measured result, and a buyer should test it on its own files. But the method is right whatever the tool: multiply the analyst and investigator days per ring by the rings you expect to work, add the licence, and compare.

The end product in Fraud Network Analysis: a lead approved, with the referral clock shown

How do you evaluate link analysis software? A trial on your own rings

Evaluate link analysis software with a short trial on your own claim files, scored with the rubric above, and built around rings your unit has already proved. A vendor demonstration on the vendor's data tests the vendor's data.

A workable trial has four steps. First, pick three to five closed rings, with their claim files and the investigators who worked them, and a few months of ordinary claims around them. Second, give each candidate read access to the same files and ask it to find the rings without being told where they are; note which it draws, at which claim, and with which links. Third, have the original investigators score every link in the drawn rings against its source, and every name match against the documents. Fourth, ask each candidate to produce a lead for one ring and have the SIU manager say whether they would sign it. The rubric totals then rest on your files rather than on anyone's slides. The eight documents a link analysis tool must read lists what to put in the trial.

Fraud Network Analysis is built to be tested that way: it runs on a sample of the unit's own claim files, with the unit's SIU procedures and referral requirements, before anything else. Where it does not fit is equally clear. It is not a general-purpose intelligence platform for law enforcement, it does not reach into public records or other carriers' data, and it is not a case management system for running interviews and examinations. For the investigation itself, see SIU Case Management; for the links, start from Fraud Network Analysis.

Questions people ask

What features should link analysis software have?

For an SIU: reading claim documents, not just fields; sourced links that open their page; scored name matching with a human review band; hub handling; nightly rebuilding over the whole look-back; ranked rings with reasons; plain-language questions with cited answers; drafted leads with numbered exhibits; a watch list that alerts without holding; versioned, approved settings; and a full audit trail.

Is link analysis software only for law enforcement?

No. The method grew up in law-enforcement intelligence, and its standards are still the clearest statement of good practice, but insurers' special investigations units, bank fraud teams and auditors use it too. The difference is the data: an SIU's links are in claim files, so its software has to read them.

Should link analysis software use AI?

Where it helps with reading and matching, yes; for deciding, no. Insurers in NAIC surveys report that their fraud referral models mostly augment human decisions. In Fraud Network Analysis, agents read, match, draw and draft, and people decide what is a lead, approve every referral and change every rule.

Can link analysis software replace an SIU case management system?

No. Link analysis finds and explains connections; case management runs the investigation, its tasks, interviews, examinations under oath and referrals. They should hand off cleanly: a ring becomes a lead, the lead becomes a case, and the case's outcome comes back to tell the analyst whether the ring was real.

How long should a trial take?

Long enough to run three to five proven rings through each candidate and have the original investigators score the results. The deciding factor is usually how quickly the vendor can be given read access to the documents, not how quickly it can draw.