Insurance fraud reporting requirements by state: ten rules compared

Insurance fraud reporting requirements by state share one idea and differ in every detail. The NAIC's model act states the idea: a person in the business of insurance "having knowledge or a reasonable belief that a fraudulent insurance act is being, will be or has been committed shall provide to the commissioner the information required". States that adopted the duty then set their own deadline, their own trigger and their own agency. Kentucky wants a report within 14 days of the determination, Texas and New York within 30, California within 60 days after determining that a claim appears fraudulent, and Montana within 60 days of discovery. Florida, Maryland, Virginia, Minnesota and Delaware require the report without naming a number of days.

For an insurer's special investigations unit, the hard part is not knowing one rule but running all of them at once, on cases that move. Botminds' SIU Case Management is case management software for SIUs that keeps each case on the clock of the state the claim is in, from the date the SIU manager confirms the determination, and drafts the state referral from the case board with every fact cited. This guide sets out ten states' rules from their own text, then the five things a case file has to store to keep every clock honest. Sample screens show a fictional carrier, Halden Mutual, and invented cases.

Do insurers have to report suspected fraud?

In most states, yes, and the duty belongs to the insurer, not only to its SIU. The NAIC counts insurance fraud as a crime in 48 states and fraud bureaus in 42 states and the District of Columbia (NAIC). In several of the states compared here the duty also covers producers, adjusters and others in the business of insurance. Texas puts it on "the person" who makes the determination or suspects; Maryland on "an authorized insurer, its employees, fund producers, insurance producers" and others with good-faith cause to believe; Virginia on "any insurer, any employee thereof, or any insurance professional".

The wording of the trigger varies more than the duty. Some states key it to knowledge, some to belief, some to a determination. California's SIU regulation adds a gloss that matters in practice: a referral is owed once the facts create a reasonable belief that someone may have committed, or is committing, insurance fraud (§ 2698.37(b)). That is a lower bar than proof, and it means the SIU's own note of when it formed the belief is evidence in any later question about timeliness.

What is the fraud reporting deadline in California and in Texas?

California: 60 days. The Department's FD-1 form gives insurers 60 days from determining that a claim appears fraudulent, citing Insurance Code § 1872.4 (the form is read field by field in the FD-1 guide), and adds that workers' compensation cases go to both the Fraud Division and the local District Attorney within 60 days under § 1877.3. The regulation then requires that referrals "be made within the period specified by statute", which makes a late referral a breach of the SIU rules, punishable by up to $5,000 an act or $10,000 if wilful (§ 2698.42).

Texas: 30 days, from a trigger that can come earlier. The insurer must report in writing "Not later than the 30th day after the date the person makes the determination or reasonably suspects that a fraudulent insurance act has been or is about to be committed in this state". Reasonable suspicion can arise before a formal determination, so an SIU that dates every Texas clock from its determination may be counting from a later day than the statute allows. The statute is § 701.051; the next section, § 701.052, is the immunity that protects the reporter.

When does the fraud reporting clock start?

At the trigger each state names, and the triggers are not the same event. New York's runs from the "determination by such person that the transaction appears to be fraudulent". Texas's runs from the determination or reasonable suspicion. Montana's runs from discovery: an insurer with reason to believe that fraud has occurred "shall report the suspected fraud to the commissioner or to the insurance producer's or other person's insurer within 60 days of discovery of the occurrence", and an insurer that receives such a report from a producer forwards it within 30 days if fraud looks reasonably likely. Kentucky's 14 days run from the determination.

The practical consequence is that a case file has to store the trigger date, not just the deadline. A deadline is arithmetic from a trigger; if the trigger is lost, so is the ability to show that the referral was on time. In the solution, the SIU manager confirms the determination on the case, the clock starts from that date by the claim's state, and the investigator and coordinator are warned 14 days before the limit, the manager seven days before. Where a statute sets no period, the sample SIU applies its own 30 days, a setting rather than a rule.

The clock on the case, from the date the manager confirmed the belief

Which states set no deadline, and what do they expect?

Five of the ten require a report without a stated period. Florida's statute says an insurer with knowledge or belief that a fraudulent act is being or has been committed "shall send to the Division of Criminal Investigations a report or information pertinent to such knowledge or belief". Maryland requires a written report on good-faith cause to believe; Virginia requires an insurer to "furnish and disclose any information in his possession concerning the fraudulent act to the Department", which in that title is the State Police. Minnesota sends reports to its Bureau of Criminal Apprehension, and Delaware's statute requires reports to its Fraud Bureau on a prescribed form.

No day count is not the same as no deadline. A regulator in any of these states can still ask whether the insurer reported in a reasonable time, and Florida separately requires every insurer to report annual fraud data by 1 March, including how many cases it referred to the Division (§ 626.9891(5)). A unit that sets its own internal period for these states, and records it, has an answer ready when an examiner asks how it defines "promptly".

Minnesota's rule that stops the claim clock

One state links the fraud report to the insurer's claim deadlines directly. In Minnesota, if an insurer has reasonable or probable cause to believe fraud and has properly notified the Bureau of Criminal Apprehension, the notice "tolls any applicable time period in any unfair claims practices statute or related regulations", and any bad-faith action on the claim, until 30 days after the Bureau decides not to recommend action and tells the insurer. The report becomes part of the claim's timeline as well as the fraud file's.

Other states handle the same tension through their claims rules rather than the fraud statute. California lets an insurer take 80 days instead of 40 to accept or deny a claim where specific information supports a belief that it is fraudulent. Those claim clocks belong to the claims desk; prompt payment laws by state sets them out, and the claimant's view of an SIU investigation explains what the extension means from the other side.

Are insurers immune for reporting fraud?

Yes, for good-faith reports, in each of the states that state an immunity in these rules. Texas bars civil actions, including for libel or slander, against a person who furnishes information about a fraudulent act to the department, law enforcement or the NAIC, but the protection "does not apply to a person who acts with malice, fraudulent intent, or bad faith". Maryland's protection requires that the reporter "acted in good faith". Florida's applies to reports filed without malice, Montana's in the absence of malice, and Minnesota's to information released in good faith.

Reports submitted to a person or entity other than the division shall not satisfy the reporting duty of KRS 304.47-050(2).

Kentucky’s reporting regulation, 806 KAR 47:010 § 6

Immunity attaches to the right recipient, which is why Kentucky's sentence matters. A report sent only to an industry database, or to another insurer, is not a report to the state there; Kentucky lists the NAIC's Online Fraud Reporting System, the National Health Care Anti-Fraud Association and the National Insurance Crime Bureau as intermediaries an insurer may use in addition to, not instead of, the Division's portal or the uniform form. Texas, by contrast, lets a member of an anti-fraud organisation authorise that organisation to report on its behalf, while keeping the liability if the report is not made properly.

What happens if an insurer reports fraud late?

It depends on the state: some set penalties, and every state's examiners can look at timeliness. California's penalties are explicit: up to $5,000 for each act of non-compliance with the SIU regulations and $10,000 for each wilful act, and the Department weighs the quantity and quality of referrals when it chooses insurers for SIU compliance reviews. Florida can fine an insurer up to $2,000 a day for failing to keep its anti-fraud unit, plan, training and data reporting in order. Elsewhere a late report is evidence that the insurer's antifraud program is not working, which an examiner may note.

Late reports tend to trace back to the case file: the trigger date was never recorded, the case moved between investigators, the form needed facts that were in the file but not in the right place, or the portal was unavailable on the last day. Each is a case-file problem before it is a compliance problem. The FD-1 form in California follows one referral through to filing.

Every open case, ranked by how far its state clock has run

How a multi-state SIU keeps ten rules at once

By treating the rules as data on the case, not as knowledge in people's heads. A table of states, each with its deadline, trigger, agency, form and channel, changes slowly but does change: Florida renamed its fraud division the Division of Criminal Investigations, and Delaware reissued its reporting bulletin in 2024, 2025 and 2026. When the table changes, every open case's clock should change with it, with the version recorded so an old case can be explained under the rule that applied at the time.

That is how the solution is built: each state's rule is a setting, versioned and on the audit trail, and every case runs on the clock of the state the claim is in. The forms are the other half of the problem; the uniform suspected insurance fraud reporting form covers how one case maps to several states' forms without typing anything twice.

Questions people ask

How long do insurers have to report fraud?

It depends on the state: 14 days in Kentucky, 30 days in Texas and New York, and 60 days in California and Montana, each counted from a different trigger. Florida, Maryland, Virginia, Minnesota and Delaware require reports without naming a number of days in the statute.

Which states require insurers to report fraud?

Most of them. The NAIC counts fraud bureaus in 42 states and the District of Columbia, and its model act makes reporting mandatory for anyone in the business of insurance with knowledge or a reasonable belief of fraud. Each state's own statute decides the details, so check the rule where the claim is.

Does the clock start when the claim is referred to the SIU?

Not in these states' wording. The clocks run from the determination that a claim appears fraudulent, from reasonable suspicion in Texas, or from discovery in Montana. A referral from claims to the SIU often comes earlier, so an SIU that dates its clocks from the internal referral is stricter than the law requires.

Can a fraud report be made through the NAIC or NICB instead of the state?

Sometimes. Texas accepts reports in the NAIC's format and lets a member authorise an anti-fraud organisation to report for it. Kentucky allows intermediaries such as the NAIC's Online Fraud Reporting System only in addition to its own portal or the uniform form, and says reports to anyone else do not satisfy the duty.

Do insurers have to report fraud if the claim was already paid?

Yes, where the belief exists. The NAIC's antifraud plan guideline says a claim may contain evidence of suspected fraud regardless of payment status, and California's Department confirmed in 2024 that a claim settled before the investigation finished should still be referred.