The situation
A car pulled out of a side road and struck a minibus at low speed. Nobody was taken to hospital. Within three weeks the motor insurer had received eleven personal injury claims from the minibus passengers, each supported by a medical report from the same clinic.
The insurer's special investigations unit had seen the pattern before. Its own analytics had flagged 53 claims over three years that shared some feature with this one. Flags are not proof, and the unit could not decline 53 claims on a statistical resemblance.
The question
Are these claims connected to the same people? If so, who organizes them? And which of the 53 are honest claims that happen to look similar? The third question was the client's, and it shaped the scope: public information relevant to each claim, agreed in writing, and nothing beyond it.
What we did
A lead investigator, two analysts, a corporate records analyst and an image analyst worked the case with a red-team reviewer. We did not contact claimants, did not use pretexts and did not look at private accounts.
1. Read the scene photographs
Claimants had submitted their own photographs of each collision. The same tow truck, identifiable by its livery and a damaged light bar, appeared in the background of 17 scenes reported by people who said they did not know each other. In four of them it was already present in photographs taken before the time the collision was reported.
2. Followed the repairs
Two repair shops had produced the estimates for 39 of the claims. Company registry filings showed that both shops and the towing company shared a director.
3. Matched the phone numbers
Six phone numbers given on claim forms also appeared in public classified advertisements: some selling used cars, others offering "accident help" to drivers. One number advertised both.
4. Checked the vehicles' histories
Fourteen of the vehicles had been advertised for sale as damaged in public listings shortly before their collisions. In nine cases the damage visible in the sale photographs matched the damage later claimed.
5. Built the network
Registry records, advertisements and the claim files converged on nine people: the shared director, the tow operator, three officers of a claims management firm, two recruiters who placed the advertisements, a repair shop manager and an administrator at the clinic.
6. Cleared the honest claims
Seven of the 53 claims had no connection to any of this. Their scene photographs geolocated to the places and times reported, their vehicles had clean histories and their repairers were unrelated. In one, a passer-by had posted dashboard camera footage of the collision. We reported all seven as genuine in the first week so the insurer could pay them.
7. Tried to break it
The reviewer argued that the two repair shops were simply the busiest in their area, and that popular shops will appear in many claims innocently. Their share of the flagged claims was eleven times their share of the insurer's other local repairs. Popularity also does not explain damage that existed before the collision or a tow truck that arrived before it.
| Line of evidence | Source type | Claims touched |
|---|---|---|
| Same tow truck at the scene | Claimant photographs | 17 |
| Two repair shops with a shared director | Repair estimates, company registry | 39 |
| Phone numbers reused in public advertisements | Claim forms, classified listings | 22 |
| Damage advertised before the collision | Public vehicle sale listings | 14 |
| Medical reports from one clinic administrator | Claim files | 31 |
What we found
- High confidence: 46 of the 53 claims were organized by one ring.
- High confidence: eight organizers identified, each tied to the ring by at least three independent lines of evidence.
- Moderate confidence: the clinic administrator took part knowingly.
- Genuine: seven claims had no connection to the ring and were supported by the public record.
The administrator's name was on 31 medical reports, but a busy administrator signs many reports. Only one independent source type tied her to the organizers. We referred her with the others, labeled the difference clearly and said what records would resolve it.
The outcome
The seven genuine claims were paid within days of our interim report. The full report followed in week four.
- $4.1M in claims declined, each with a documented basis.
- $1.7M recovered through civil action on claims already paid.
- Nine individuals referred to law enforcement and to the industry's fraud bureau. Six have been charged.
- The ring's indicators were added to the insurer's claims analytics, so the next attempt is caught at first notification.
What made the difference
The insurer's analytics had found the resemblance. What it needed was evidence that separated a ring from a coincidence, one claim at a time. The answer was in material the claimants had supplied themselves, read alongside public records nobody had thought to compare it with.
Proportion was not a constraint on the investigation. It was what made the result usable. Every declination could be defended, and seven customers who had done nothing wrong were paid without ever knowing they had been doubted.