Link analysis tools connect records that share an identifier, such as a phone, an address, a provider or an account, and draw the result as a network so an investigator can see which claims belong together. For insurance fraud, the tool is only as good as what it is allowed to read. The identifiers that tie a ring together sit mostly inside claim documents: the callback number in the first-notice call log, the "referred by" line on a clinic intake form, the attorney on a letter of representation, the tow yard and dispatch time on an invoice, the card that paid the premium. A tool that reads only the claim system's structured fields will draw a tidy chart of the wrong network. Botminds' Fraud Network Analysis was built around that problem: its link reader takes the identifiers out of the documents themselves, with the page and line each came from, before anything is drawn.
The worked example is a fictional sample carrier, Keywater Insurance Company, and its South Florida special investigations unit; every name, phone and claim is invented. The rules that make each document exist are linked where they appear.
The eight documents a link analysis tool must read, and what each holds
1
First-notice call log
Holds
Caller's name as given, callback number, relationship to the driver, time of call, what was said
Why it matters
The runner or organizer often makes the call. In the sample ring one callback number is on all eleven calls.
2
Application for benefits
Holds
Names, addresses, dates of birth, employer, treating provider for each occupant
Why it matters
In New York the NF-2 starts the insurer's verification clock; it is where a shared apartment first appears.
3
Clinic intake form
Holds
"Referred by" name and phone, attorney, first visit date, complaint
Why it matters
Florida makes most direct solicitation of crash victims within 60 days a felony, so a referral line matters.
4
Medical bill (CMS-1500)
Holds
Provider, billing address, billing phone, tax ID, professional license number
Why it matters
Florida requires PIP bills on the CMS-1500 with the provider's license number. Two clinics, one billing address, show up here.
5
Letter of representation
Holds
Attorney or firm, date, the clients it names
Why it matters
One firm on most claims of a ring, with letters inside a week of the loss, is a pattern no single file shows.
6
Tow invoice and dispatch record
Holds
Tow company, dispatch time, who summoned it and their phone, storage yard
Why it matters
California requires a tow operator summoned by a driver to hold the caller's name and phone in writing. A dispatch before the claim call is a timing link.
7
Policy declarations and premium payment
Holds
Bind date, named insured, agent, card or account that paid the premium
Why it matters
New policies bound weeks before a loss, paid with one card in several names, link claims across policies.
8
Claim payment record
Holds
Payee, payout account, address the check went to
Why it matters
One account receiving settlements for several claimants is the strongest link there is.
What are link analysis tools, and what do they need to read?
Link analysis tools are software that store entities and the relationships between them, find the paths and clusters, and draw them as charts. The law-enforcement analytic standards place them in a wider kit: analytic software "generally falls into five categories—databases, spreadsheets, visualization, mapping, and text/data mining" (Law Enforcement Analytic Standards, 2nd edition, 2012). Most link charting tools sit in the visualization category. They expect someone else to have done the database and text-mining work first.
In an SIU, that someone is usually the analyst, by hand. The tool gets a spreadsheet of claims and parties exported from the claim system, and draws what is in it. What is in it depends on what adjusters and intake staff typed, which is rarely the callback number a caller gave, the referral line on a clinic form or the dispatch time on a tow invoice. So the first question to ask of any link analysis tool for fraud is not how it draws, but what it reads.
Why claim fields miss the links that matter
Claim systems are built to pay claims, so they capture the parties a payment needs: the insured, the claimant, the payee, perhaps the attorney once a suit is filed. The parties a ring needs to hide, the organizer who made the call, the runner who referred the clinic, the tow operator who arrived first, have no reason to be keyed in.
Where each ring link actually lives in a typical claim file
In the claim system's fields: Often the insured's phone from the policy, or blank.
In the documents: The number the caller gave, in the first-notice call log, under whatever name they gave.
In the claim system's fields: Usually no field at all.
In the documents: The "referred by" line on the clinic intake form, sometimes with a phone.
In the claim system's fields: Entered when a suit or demand arrives, if at all.
In the documents: The letter of representation, often within days of the loss.
In the claim system's fields: The payee name on a bill.
In the documents: Billing address, billing phone, tax ID and license number on the CMS-1500.
In the claim system's fields: A vendor payee, if the carrier paid it.
In the documents: The invoice: company, dispatch time, storage yard, who summoned it.
In the claim system's fields: In billing, not claims.
In the documents: The premium payment record: the card or account and who used it.
The research confirms that the parties matter. The KU Leuven study that found network features beat claim-only features built its network from "the policyholders, brokers, experts, and garages" on each claim (Óskarsdóttir et al., 2020), all of which that insurer happened to hold as structured data. Most U.S. auto claim files do not hold the equivalent for runners, referral sources and tow operators. They hold them in paper and PDF.
What links matter most in insurance fraud?
The links that matter most are the ones that cost a ring money or effort to change: bank accounts, phones and payment cards first, then addresses, then the professionals a ring uses, which are also used by honest claimants. In the fictional sample unit the fraud analyst has weighted a shared bank account at 1.00, a phone at 0.90, a card at 0.80, an address at 0.60, a witness at 0.50, an attorney or clinic at 0.40 and a tow yard at 0.30.
Carriers report using a similar mix. Asked which data elements their fraud models used, private passenger auto insurers told the NAIC loss experience (80 companies), vehicle-specific data (68), medical data (67), criminal conviction data (43) and online media (29), and one wrote that it uses addresses to find possible personal relationships in fraud ring detection (NAIC private passenger auto AI/ML survey, 2022). California's consumer guidance on staged accidents adds the timing links: passengers listed who were not in the car, witnesses who were not at the scene, and an attorney who makes contact without being asked (California Department of Insurance). Every one of those is read from a document.
Can link analysis read documents?
Some link analysis tools can, most cannot, and the difference decides how much of a ring you see. A charting tool imports rows. A tool that reads documents has to find the identifier on the page, normalize it, keep the page and line it came from, and do it again every time a new document arrives on any claim in the look-back.
What the Fraud Network Analysis link reader takes from one claim file
The source matters as much as the reading. An investigator who puts a link in a referral will be asked where it came from, and the law-enforcement analytic standards set the rule: "Information collected from all sources shall be evaluated and designated for source reliability, content validity, and relevancy" (Law Enforcement Analytic Standards). In Fraud Network Analysis every link carries the claim, the document and the line it was read from, and the reader is built never to write down an identifier that is not on the page.
When the links arrive: one claim's first sixteen days
A ring's links do not arrive with the claim; they arrive over the following weeks, one document at a time. That is the practical reason a link analysis tool has to re-read the book continuously rather than once.
The documents behind one sample claim, by day after the first-notice call
- Call log, tow invoiceday 0
- Intake formsday 2
- Attorney letterday 5
- Paymentday 7
- PIP application; second payment day 16day 8
Two things follow. First, by the time the attorney's letter and the application arrive, the claim has usually been paid at least once, so a tool that only looks at a claim when it opens sees the least of it. Second, the link that tips a group into a ring often arrives on a different claim: the eighth letter from the same firm, or the sixth intake form with the same referral line. Fraud Network Analysis re-reads every new or changed document each night, 3,418 documents on 1,206 claims on the sample night, and rebuilds the map over the whole 24-month look-back.
The documents also carry the law's own markers. Florida's PIP statute requires bills on a CMS-1500 or other approved form and requires providers other than hospitals to "include on the applicable claim form the professional license number of the provider" (Fla. Stat. § 627.736(5)(d)), which makes the bill the place to tie a clinic to a licence. Florida also bars soliciting crash victims for PIP or tort claims by direct contact "within 60 days after the occurrence of the motor vehicle accident" (Fla. Stat. § 817.234(8)(b)), which makes a referral line dated two days after a crash worth reading. California requires a tow operator summoned by a driver to hold, in writing and before arriving, the summoner's name and working phone number (Cal. Veh. Code § 22513), which turns a tow record into a phone link.
How do you prepare data for link analysis?
Prepare for link analysis by giving the tool access to the documents and the systems they live in, not by building a cleaner export. The work an SIU does before go-live is mostly about access, rules and examples: which stores the tool may read, which identifiers count, which values are known hubs, and which past rings it should find.
What an SIU brings to go live with Fraud Network Analysis
- Claims and party records
Claims, policies, people, payments and reserves for the look-back, from the claim system.
- The document store
Read access to the first-notice call logs, applications, intake forms, bills, attorney letters, tow invoices and notes, where they already live.
- Provider, attorney and shop details
Billing forms, billing addresses and tax IDs, as held in bill review or vendor files.
- Premium and payout records
The cards and accounts that paid premiums and received payments, from billing and disbursement.
- The SIU's own watch list
Phones, people, providers, shops, cards and accounts the unit already watches.
- Known hubs
The carrier's own numbers and addresses, national tow and glass dispatch lines, the busiest hospitals.
- SIU procedures and referral rules
Approvers, the referral clock in each state, and what a lead must contain.
- A few proven rings
Closed cases the unit already knows, to check that the tool draws them, and when.
The last item is the one most often skipped and most worth doing. A set of rings the unit has already proved is the only honest test of whether a tool reads the right documents: if it cannot draw a ring you know about from the files that contain it, it will not draw the ones you do not. Five tests a detected ring must pass describes how to run that replay and what to measure.
Are there free link analysis tools?
Yes, and for drawing a chart from a clean list they are fine. Spreadsheets, diagramming software and open-source graph libraries can all draw nodes and lines, and a careful analyst can build a useful chart for one case with them. The law-enforcement analytic standards treat that kind of chart as one product of a network analysis among several, alongside an association matrix, a map, a summary and recommendations (Law Enforcement Analytic Standards).
What free tools do not do is the reading. Someone still has to open every call log, intake form and letter, type the identifiers, match the spellings and keep the sources, and do it again when the next document arrives. That is the part that takes the weeks, and the part that decides whether a ring is seen at its fourth claim or its fourteenth. How a chart should be read once it exists is covered in link analysis chart: how to read one, link by link.
How long does it take to set up link analysis?
Setting up link analysis takes as long as getting read access to the documents and agreeing the rules; the drawing is the quick part. Carriers whose call logs, intake forms and letters already sit in a document store the claim system can reach are in a different position from those whose first-notice calls live in a separate telephony system or whose provider bills sit with a bill review vendor.
The rule-setting takes longer than buyers expect, because it is where the SIU decides what it believes. Which identifiers link, how much each weighs, which hubs to set aside, how large a group must be, who approves a change: those are judgements for the fraud analyst and the SIU manager, and in Fraud Network Analysis each is a setting that changes only with both of them. The fastest honest route is to run the tool first on a sample of the unit's own claim files, including a few proven rings, and set the rules from what it draws.
One link, opened at its source
Where Fraud Network Analysis fits among link analysis tools
Fraud Network Analysis fits an SIU that already holds its claim documents and wants the reading, linking and ring-drawing done every night, with every line sourced and every decision left to its people. It reads the eight documents above and the claim, payment and watch-list records beside them, and it answers plain questions such as "who else uses this phone?" with the claim and document behind each sentence.
It is not a document intake or fraud scoring system for single claims, and it does not judge whether a bill or invoice has been altered; those are separate jobs, covered by Document Fraud Detection and Claims Fraud Detection. Nor does it reach outside the claim file: if a link exists only in a public record or another carrier's data, it will not draw it. What it changes is how much of an SIU's own paper becomes searchable as links. To see that on a sample of claims, start from Fraud Network Analysis.
Questions people ask
What data do link analysis tools need?
At minimum, a list of entities and the relationships between them. For insurance fraud that means claims, the people and businesses on them, and the identifiers they share: phones, addresses, providers, attorneys, tow yards, cards and accounts. The richest of those sit in documents, so the real requirement is read access to call logs, applications, intake forms, bills, attorney letters and invoices.
What is the best link analysis tool for fraud?
The one that reads the documents your rings write on, keeps the source of every link, handles hubs and redraws the network as claims arrive. Drawing quality matters far less. Test candidates on rings your unit has already proved: a tool that cannot draw them from the files that contain them will not find new ones.
What is the difference between a link analysis tool and a graph database?
A graph database stores entities and relationships and answers queries over them; a link analysis tool adds the charting, and sometimes the analysis, on top. Neither reads documents on its own. For an SIU the deciding layer is the one that turns claim documents into sourced links before either is used.
Why read the tow invoice at all?
Because it holds a time and, in some states, a phone. California requires a tow operator summoned by a driver to hold the summoner's name and phone number in writing before arriving. In the sample ring, the tow yard was dispatched before the claim was called in on six of eight claims, a timing link that exists nowhere but the invoice.
Do link analysis tools need personal data?
Yes: names, phones, addresses and accounts are the links. That makes access control and logging part of the setup. In Fraud Network Analysis every search, expansion, name match and watch-list entry is recorded with who did it and when, and the tool reads only documents in the claim file.