13. Investigation, Case Management and Recovery

Introduction and Context

Fraud detection creates value only when a suspected case is converted into a disciplined, defensible and economically useful investigation. Detection models may identify anomalies, but they do not establish liability. Investigation supplies the factual process through which an insurer determines what happened, who was involved, whether policy terms were breached, what evidence supports the conclusion, and what action is proportionate. Case management then coordinates this work across claims, special investigation units, legal advisers, compliance functions, investigators, experts and, where appropriate, law-enforcement agencies. Recovery completes the cycle by seeking restitution, preserving subrogation rights, pursuing third-party liability and improving future controls.

Insurance investigations are distinctive because they operate at the intersection of contract, evidence, customer service, privacy, regulation and commercial judgment. An insurer must investigate objectively rather than assume that an unusual claim is fraudulent. It must also protect legitimate policyholders from unnecessary delay and intrusive questioning. A weak investigation can produce an unjustified repudiation, regulatory criticism, reputational damage or litigation loss. A well-managed investigation creates reliable evidence, supports fair claims decisions and generates intelligence for underwriting and risk management.

This chapter presents an integrated workflow from triage to closure and recovery. It also examines interviewing, digital evidence, chain of custody, litigation readiness, analytics, governance and the evaluation of investigation quality and return on investment.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Design a risk-based triage and investigation workflow.

2. Distinguish intelligence, allegation, evidence and proof.

3. Plan and conduct effective investigative interviews.

4. Collect, preserve and analyse documentary and digital evidence.

5. Maintain a credible chain of custody and an auditable case file.

6. Coordinate claims, legal, compliance, experts and law enforcement.

7. Manage litigation, recovery, subrogation and restitution decisions.

8. Evaluate investigation quality, timeliness, proportionality and return on investment.

9. Recognise ethical, privacy, procedural and professional risks.

From Suspicion to an Investigable Case

A referral is not a finding. It is an indication that a claim, policy or transaction deserves additional examination. Referrals may arise from predictive models, claims handlers, whistle-blowers, customers, brokers, hospitals, repairers, internal audits or law-enforcement information. The first professional task is to separate the reason for referral from the hypothesis being tested.

Four concepts should be kept distinct. Intelligence is information that may assist direction-setting but has not necessarily been verified. An allegation is an assertion that misconduct occurred. Evidence is information capable of supporting or weakening a proposition. Proof is the persuasive body of evidence that satisfies the applicable decision-maker or legal standard. Confusing these categories encourages confirmation bias: investigators begin by seeking material that supports the initial suspicion and overlook exculpatory facts.

A case hypothesis should therefore be expressed as a testable proposition. For example, instead of recording “claimant is suspicious,” the investigator might record: “The reported theft may not have occurred on the stated date because access records, device activity and witness accounts indicate continued possession.” Alternative hypotheses should also be documented, such as reporting error, misunderstanding, third-party involvement or a genuine loss with inaccurate timing.

Triage and Proportionality

Triage determines the appropriate level of response. It should be based on risk and materiality, not merely on the presence of a red flag. A useful triage assessment considers:

• potential financial exposure and recoverability;
• severity of suspected conduct and possible public harm;
• strength and reliability of initial indicators;
• regulatory, sanctions, money-laundering or organised-crime implications;
• vulnerability of the claimant and urgency of legitimate benefits;
• availability and volatility of evidence;
• complexity, geography and number of parties;
• likely investigation cost relative to expected benefit.

Cases can be classified as routine verification, enhanced desktop review, formal investigation or critical escalation. These categories should not become rigid labels. A low-value case may require urgent action where evidence is at risk, while a high-value case may be resolved through a simple documentary clarification. Proportionality means that investigative intensity is justified by the expected value and risk of the decision.

A triage record should identify the referral source, facts known, information gaps, initial hypothesis, risk rating, assigned owner, deadlines, conflicts of interest and approval required. It should also state what action must not yet be taken. For example, a claim should not automatically be declined merely because an investigation has been opened.

The Investigation Workflow

A defensible investigation is a managed sequence rather than an informal search for suspicious facts.

1. Intake, Conflict Checking and Scoping

The case manager opens a unique case record and confirms the policy, claim, parties, relevant dates, coverage issues and referral reason. Conflict checks are essential where employees, brokers, suppliers or external investigators have personal or commercial relationships with a party. The scope should define the questions to be answered, the jurisdiction, the evidence required, the authority limits and the expected decision point.

2. Preservation and Initial Risk Control

Evidence can disappear through routine deletion, device replacement, alteration of documents or changes to a scene. A preservation plan identifies relevant systems, custodians, records and retention periods. Immediate controls may include securing damaged property, placing a legal hold on relevant records, restricting access to a claim file, notifying a reinsurer or protecting a threatened recovery right. Controls must be lawful and no broader than necessary.

3. Planning the Evidence Strategy

The investigator creates an evidence matrix linking each issue to possible sources. If the issue is the date of a loss, sources might include notification metadata, access-control logs, bank transactions, geolocation records, medical records, photographs, weather data and independent witnesses. The matrix records relevance, reliability, accessibility, privacy sensitivity and the method of preservation. This reduces random collection and helps expose gaps.

4. Collection and Verification

Collection should proceed from less intrusive and readily available sources to more intrusive methods, unless urgency dictates otherwise. Original documents, system exports, photographs, statements and expert reports should be preserved with associated metadata. Each item receives an identifier and a record of who collected it, when, where, how and under what authority. Investigators should seek contradictory as well as corroborative material.

5. Analysis and Interviews

Evidence is analysed chronologically and relationally. A timeline can reveal whether events are physically possible, whether accounts changed and whether communications preceded the alleged loss. Link analysis can show relationships among claimants, repairers, witnesses, accounts and prior claims. Interviews test the evidence and give individuals an opportunity to explain inconsistencies.

6. Evaluation and Decision

The investigator prepares a findings report that distinguishes facts, source reliability, unresolved issues, inferences and conclusions. The decision-maker applies the relevant policy wording, internal authority and legal standard. Possible outcomes include payment, partial payment, further verification, claim denial where legally justified, referral to authorities, recovery action or closure with no adverse finding.

7. Closure, Learning and Recovery

Closure requires a complete chronology, evidence index, interview notes, decision rationale, communications, financial result, lessons learned and retention instruction. Where fraud or third-party liability is established or strongly supported, recovery options are assessed. Case intelligence should be translated into model feedback, control improvements and training without labelling people unfairly or retaining unnecessary personal information.

Interviewing as an Evidence Skill

An interview is not a contest or an opportunity to force an admission. It is a structured method for obtaining an account, testing memory and identifying evidence. Preparation begins with a chronology, known facts, inconsistencies and clear objectives. Investigators should understand the interviewee’s role, language needs, vulnerability and relationship to the claim.

A commonly effective sequence is: explain purpose and process; establish rapport; invite an uninterrupted account; ask open questions; clarify time, place, people and actions; test discrepancies with specific documents; ask whether there is anything else; and confirm next steps. Open prompts such as “Please describe what happened from the beginning” are usually more informative than leading questions. Closed questions are useful for precision after the narrative has been obtained.

Interview records should distinguish verbatim quotations, paraphrase, investigator observation and interpretation. The method of recording must comply with applicable law and organisational policy. Audio or video recording may improve accuracy but requires appropriate notice, consent or other legal authority where required. An interviewee should not be threatened with loss of benefits, misled about material facts or denied a reasonable opportunity to respond.

Interview quality can be weakened by confirmation bias, excessive jargon, repeated questioning, premature confrontation, cultural misunderstanding and failure to recognise trauma or cognitive impairment. In serious cases, a specialist interviewer, interpreter, legal adviser or support person may be necessary. An inconsistency is not automatically deception; memory, stress, translation and ordinary estimation errors must be considered.

Digital Evidence and Analytical Reconstruction

Modern claims generate evidence from claims platforms, email, messaging applications, mobile devices, vehicle telematics, access systems, payment records, cloud services, social media, photographs and connected sensors. Digital material is powerful because it can establish sequence and association, but it is also fragile, easily misunderstood and subject to privacy restrictions.

Investigators should preserve the original or a defensible forensic image where appropriate, calculate a cryptographic hash for relevant files, document the extraction method and retain read-only copies. System-generated timestamps must be interpreted with attention to time zones, clock drift, daylight-saving changes, synchronisation and system configuration. Metadata can indicate when a photograph was created or modified, but it does not alone prove who took it or what it depicts.

A digital evidence plan should answer five questions: what proposition is being tested; which system is likely to contain relevant data; who controls that system; what authority permits access; and how authenticity and completeness will be demonstrated. Data minimisation is important. Collecting an entire personal device when a narrow export would answer the question may be disproportionate and unlawful.

Analytics can assist reconstruction. Sequence analysis compares reported events with transaction and device timelines. Entity resolution identifies whether different records refer to the same person or organisation. Network analysis can identify repeated associations among claimants, suppliers and witnesses. Natural-language tools may prioritise documents or detect repeated wording, but automated results are investigative leads, not conclusions. Human review remains necessary because models can reproduce data-quality problems, cultural bias and false associations.

Chain of Custody and Case File Integrity

Chain of custody is the documented history of an evidence item from acquisition through storage, transfer, analysis and presentation. Its purpose is to show that the item is what it is claimed to be, that it was not improperly altered and that every handling event is accountable. A chain record normally includes the item identifier, description, source, collector, date and time, method of acquisition, hash or integrity value where relevant, storage location, transfers, access and disposal or return.

A break in documentation does not always make evidence unusable, but it reduces credibility and may affect admissibility or weight. Common failures include working directly on originals, sharing files through uncontrolled channels, changing file names without recording the change, leaving evidence on personal devices, and failing to document privileged material. Access should follow least privilege, with audit logs and segregation of investigative, claims and legal functions where appropriate.

The case file should be understandable to an independent reviewer who was not involved. It should contain the referral, scope, chronology, evidence register, interview records, analysis, approvals, communications, decisions and recovery activity. Version control is especially important for reports and spreadsheets. A conclusion unsupported by a traceable evidence path is a management opinion, not a robust investigation.

Collaboration, Legal Escalation and Litigation Management

Fraud cases frequently cross functional and jurisdictional boundaries. The claims team understands policy and customer obligations; the special investigation unit contributes investigative skill; legal advisers assess privilege, procedure and exposure; compliance evaluates regulatory and reporting duties; forensic experts address technical issues; and law enforcement may investigate criminal conduct. Clear role allocation prevents duplication and inconsistent communications.

Legal escalation should be considered when there is significant exposure, threatened litigation, suspected organised activity, a need for compulsory process, privilege issues, serious personal injury, regulatory reporting or cross-border data transfer. Legal advice should not be used to conceal ordinary business records merely by copying a lawyer. Privilege depends on applicable law and purpose, and factual investigation may not automatically be privileged.

Litigation readiness begins before proceedings. Relevant records must be preserved, custodians identified, disclosure obligations understood and a litigation hold monitored. Witnesses should be prepared to tell the truth, not coached to adopt a preferred narrative. Expert reports must state assumptions, methods, limitations and the distinction between factual evidence and opinion. Settlement decisions should consider evidential strength, legal costs, delay, precedent, regulatory perception and recovery prospects.

Cooperation with law enforcement requires an identified contact, documented authority, controlled information sharing and respect for confidentiality and due process. An insurer should not conduct a private prosecution through coercive practices. Nor should it delay legitimate claim handling indefinitely while waiting for an external investigation unless the legal and operational basis is clear.

Recovery, Subrogation and Financial Closure

Recovery is broader than pursuing the person suspected of fraud. It may involve restitution, subrogation against a negligent third party, recovery from a responsible supplier, salvage, chargeback, reinsurer recovery or contractual indemnity. The correct route depends on policy rights, governing law, insolvency, evidence, limitation periods and cost.

A recovery assessment should estimate gross amount, probability of success, cost of pursuit, time to receipt, legal obstacles and reputational risk. The expected net recovery can be represented as:

Expected net recovery = probability of recovery × gross recoverable amount − pursuit cost.

This is a decision aid rather than a substitute for legal judgment. A small recovery may be worthwhile when it deters a network or protects a major control, while a technically available claim may be uneconomic or unfair to pursue.

Subrogation rights can be lost through premature settlement, waiver, failure to notify a liable party, destruction of damaged property or inadequate evidence. Claims and legal teams should therefore identify potential third parties early and preserve inspection rights. Recovery outcomes should be reconciled with finance records and linked to the originating case so that reported savings are not overstated.

Measuring Investigation Quality and Return on Investment

Counting referrals or repudiations is an inadequate performance system. A high repudiation rate may indicate strong detection, poor customer treatment or biased referral practices. Quality measurement should combine outcome, process, fairness and learning indicators.

Useful measures include median time from referral to triage, proportion of cases with documented scope, evidence completeness, review or appeal outcomes, complaint rates, legal loss rates, customer-impact measures, confirmed-fraud yield, recoveries, avoided loss and control improvements. Metrics should be segmented by product, channel, geography and referral source to identify inconsistent treatment.

A basic investigation ROI measure is:

ROI = (direct recovered amount + defensible avoided loss + other quantified benefit − investigation cost) ÷ investigation cost.

Avoided loss must be estimated cautiously. A claim not paid after investigation is not automatically a fraud saving: it may have been excluded under the policy, withdrawn, or wrongly denied. Benefits such as deterrence, regulatory protection and improved controls can be reported separately as strategic value rather than converted into speculative monetary figures.

Quality assurance should use independent sampling of closed files. Reviewers should ask whether the scope was reasonable, evidence was reliable, alternative explanations were considered, the claimant was treated fairly, the decision matched policy and the recovery analysis was sound. Findings should lead to calibration, coaching and process redesign rather than only individual blame.

Illustrative Case: The Repeated Commercial Theft Claim

Background

A fictional insurer receives a commercial property claim from a small electronics distributor reporting the overnight theft of high-value devices. The claim is material but not large enough, by itself, to justify an open-ended investigation. The automated referral system identifies that the loss occurred shortly after a policy increase and that several serial numbers resemble items appearing in an earlier claim handled by another insurer.

Situation and Problem

The referral creates a risk of fraud, but the indicators are not proof. The insurer must determine whether the theft occurred as reported, whether the inventory was owned and present, and whether another party may be liable. It must also avoid delaying legitimate payment without a reasoned basis.

Analysis and Approach

The case manager records two competing hypotheses: a genuine burglary involving recently acquired stock, and an inflated or fabricated claim involving inventory previously claimed elsewhere. A preservation notice is issued for relevant claims records, broker communications and warehouse access logs. The investigator obtains purchase invoices, serial-number lists, stock records, alarm logs, police reports, CCTV availability and bank payment evidence.

An evidence matrix shows that the stock ledger was amended shortly before the reported loss, but the amendment could reflect a legitimate physical count. The investigator interviews the owner using a narrative-first approach and then asks about the purchase, storage and serial-number process. An independent forensic accountant compares invoices with supplier bank receipts and inventory movements. A digital specialist exports access logs and preserves the original files with hash values.

The earlier insurer confirms that a subset of serial numbers was associated with a prior claim, but the numbers had been entered incorrectly in that file. Supplier records and device activation data show that most of the current stock was genuinely purchased and had not been activated. One group of devices, however, was never delivered to the warehouse. The owner explains that these items were held at a separate location, but access records and transport documents do not support the account.

Outcome

The insurer pays the supported portion of the claim, declines the unsupported items under the applicable policy provisions after giving the insured an opportunity to respond, and refers the suspected fabrication to the appropriate authority in accordance with legal advice. It also pursues a recovery inquiry against a contracted security provider for a documented alarm failure. The case is reviewed for model improvement: the strongest indicator was not the policy increase but the mismatch between delivery evidence and claimed inventory.

Learning Points

The case demonstrates the importance of testing alternative explanations, separating supported loss from unsupported loss, preserving digital records before they disappear, and avoiding an all-or-nothing response. It also shows that investigation value may arise from partial payment accuracy, recovery and control learning, not only from total claim denial.

Challenges, Ethical Risks and Common Mistakes

Investigations are vulnerable to confirmation bias, anchoring on an automated score, overreliance on a single witness, poor data quality, investigator conflicts and pressure to achieve financial targets. Organisational incentives can quietly convert fraud investigation into claim reduction. Governance should therefore protect independent professional judgment and prohibit performance systems that reward denial without regard to fairness and accuracy.

Privacy is a central constraint. Personal data should be collected for a defined purpose, accessed lawfully, retained only as long as needed and protected against unauthorised disclosure. Sensitive health, biometric, location and communications data require particular care. Cross-border investigations may involve differing rules on transfer, surveillance, recording and disclosure.

Other common mistakes include failing to preserve exculpatory evidence, treating a model alert as a conclusion, contacting suspects before securing volatile evidence, using unqualified experts, ignoring limitation periods, overlooking vulnerable claimants, and closing a case without recording why alternative hypotheses were rejected. A fair investigation is impartial, proportionate, explainable and reviewable.

Emerging Practice and Best-Practice Principles

Investigation functions are increasingly integrating graph analytics, digital forensics, automated document classification, secure evidence repositories and workflow systems. Generative AI may assist with chronology drafts, document summarisation and interview preparation, but confidential data must be governed carefully and outputs independently verified. AI should not make an adverse claims decision without accountable human review, explainable reasoning and appropriate testing for disparate impact.

Strong practice can be summarised in the following principles:

• define the question before collecting information;
• use risk-based, proportionate triage;
• preserve volatile evidence and document authority;
• test both incriminating and exculpatory explanations;
• maintain a complete chain of custody;
• separate facts, inferences and opinions;
• protect privacy, privilege and confidentiality;
• give affected parties a fair opportunity to respond;
• coordinate claims, legal, compliance and experts through clear roles;
• measure accuracy, fairness, learning and net value, not merely denials;
• convert case findings into stronger controls and better analytics.

Chapter Summary

Investigation is the bridge between fraud detection and a defensible insurance decision. Effective practice begins with proportionate triage, a testable hypothesis and a clear scope. Evidence must be planned, preserved, collected lawfully and evaluated with attention to reliability and alternative explanations. Interviews should be structured but fair, while digital evidence requires attention to authenticity, metadata, access authority and forensic integrity. Chain of custody and a complete case file support internal review, regulatory scrutiny and litigation.

Case management coordinates claims, special investigation, legal, compliance, experts and law enforcement. Recovery requires early preservation of subrogation and restitution rights and a realistic assessment of net value. Investigation performance should be evaluated through quality, fairness, timeliness, recovery, learning and carefully defined ROI measures. Technology and AI can improve prioritisation and analysis, but accountable human judgment, privacy and due process remain essential.

Key Terms

Case management: The coordinated administration of an investigation from referral through closure and recovery.

Chain of custody: The documented history of an evidence item’s acquisition, handling, storage, transfer and disposition.

Digital evidence: Electronically stored or transmitted information relevant to an investigative proposition.

Evidence matrix: A planning tool linking investigative issues to sources, relevance, reliability and preservation methods.

Exculpatory evidence: Information that tends to support innocence, legitimacy or an alternative explanation.

Forensic image: A preserved, exact or defensible copy of digital storage or data for examination.

Hypothesis: A testable proposition explaining what may have occurred.

Intelligence: Unverified or partially verified information used to guide investigative direction.

Investigation triage: Risk-based classification of a referral to determine the appropriate response.

Legal hold: A direction to preserve potentially relevant records because litigation or formal proceedings are anticipated.

Metadata: Data describing the characteristics, history or context of a digital file or record.

Net recovery: The recoverable amount after considering the probability and cost of pursuit.

Proportionality: Matching investigative intensity to risk, materiality, evidence and likely benefit.

Recovery: Financial or legal action to obtain restitution, subrogation, salvage or other compensation.

Special Investigation Unit: An organisational function specialising in suspected insurance fraud and complex claims.

Subrogation: An insurer’s pursuit of rights against a responsible third party after paying a claim.

Triage: Initial assessment of priority, risk, scope and required investigative resources.

Verification: The process of testing the accuracy, authenticity and consistency of information.

Review Questions

Short Answer Questions

1. Distinguish intelligence, allegation, evidence and proof.

2. What factors should influence investigation triage?

3. Why should investigators test exculpatory evidence?

4. What information is normally included in a chain-of-custody record?

5. State two limitations of using AI in fraud investigations.

Long Answer Questions

1. Explain the stages of a risk-based insurance fraud investigation from intake to closure.

2. Discuss professional interviewing methods and the ethical risks of coercive or leading questioning.

3. Explain how digital evidence should be collected, preserved and authenticated.

4. Analyse the roles of claims, legal, compliance, experts and law enforcement in a complex case.

5. Discuss appropriate measures for evaluating investigation quality and ROI.

Analytical / Application Questions

1. A claim is referred because the claimant recently increased coverage and submitted inconsistent photographs. Design a triage plan that avoids treating these indicators as proof of fraud.

2. A digital report shows that a file was created two days after the alleged loss. Analyse at least four possible explanations and identify additional evidence required.

3. An insurer has a strong recovery claim but the expected recovery is modest and litigation costs are high. Develop a decision framework for pursuing, settling or closing the recovery action.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a fraud referral from a fraud finding?

A. A referral establishes that policy terms were breached.

B. A referral is an indication requiring proportionate examination, not proof of misconduct.

C. A referral permits automatic claim denial.

D. A referral is admissible proof in every legal proceeding.

Correct Answer: B. A referral is an indication requiring proportionate examination, not proof of misconduct.

Question 2

What is the primary purpose of an evidence matrix?

A. To rank employees by investigation performance.

B. To replace the need for interviews.

C. To link investigative issues with relevant sources and preservation methods.

D. To calculate the insurer’s annual fraud budget.

Correct Answer: C. To link investigative issues with relevant sources and preservation methods.

Question 3

Which action most directly protects the integrity of digital evidence?

A. Renaming files for convenience without recording the change.

B. Editing the original file to remove irrelevant material.

C. Preserving the source or forensic copy and documenting extraction and integrity values.

D. Sending the evidence through a personal messaging account.

Correct Answer: C. Preserving the source or forensic copy and documenting extraction and integrity values.

Question 4

An investigator finds an inconsistency in a claimant’s account. What is the most appropriate next step?

A. Treat the inconsistency as conclusive proof of fraud.

B. Ignore it because genuine claims never contain inconsistencies.

C. Explore possible explanations, including memory, translation and stress, and seek corroboration.

D. Threaten immediate loss of all policy benefits.

Correct Answer: C. Explore possible explanations, including memory, translation and stress, and seek corroboration.

Question 5

Which metric provides the most balanced assessment of an investigation function?

A. Number of claims denied alone.

B. Total number of referrals alone.

C. A combination of accuracy, fairness, timeliness, recovery, quality and learning indicators.

D. The percentage of cases escalated to law enforcement.

Correct Answer: C. A combination of accuracy, fairness, timeliness, recovery, quality and learning indicators.

Question 6

Why should an insurer document alternative hypotheses?

A. To increase the apparent length of the case file.

B. To reduce confirmation bias and test whether evidence supports explanations other than fraud.

C. To avoid collecting evidence that contradicts the referral.

D. To ensure every claim is litigated.

Correct Answer: B. To reduce confirmation bias and test whether evidence supports explanations other than fraud.

Question 7

Which calculation is most appropriate as a basic recovery decision aid?

A. Gross claim amount divided by investigation hours.

B. Probability of recovery multiplied by gross recoverable amount, less pursuit cost.

C. Number of suspects multiplied by policy premium.

D. Claim reserve less the number of interviews conducted.

Correct Answer: B. Probability of recovery multiplied by gross recoverable amount, less pursuit cost.

Question 8

A model flags a claim as high risk. What should the insurer do?

A. Automatically deny the claim.

B. Use the score as an investigative lead subject to human review and evidence testing.

C. Disclose the model’s result as proof to the claimant.

D. Exclude all contradictory evidence from the case file.

Correct Answer: B. Use the score as an investigative lead subject to human review and evidence testing.

Question 9

Which circumstance most clearly supports early legal escalation?

A. A routine claim with complete documentation.

B. A minor spelling error in a claimant’s address.

C. Threatened litigation, significant exposure, privilege issues or suspected organised activity.

D. Any claim that exceeds a standard deductible.

Correct Answer: C. Threatened litigation, significant exposure, privilege issues or suspected organised activity.

Question 10

What is a major risk of measuring investigation success only by repudiation rates?

A. It may encourage unfair denials and conceal poor decision quality.

B. It guarantees accurate fraud detection.

C. It eliminates confirmation bias.

D. It measures recovery more accurately than net recovery.

Correct Answer: A. It may encourage unfair denials and conceal poor decision quality.