7. Statistical Risk Models and Fraud Scoring

Introduction and Context

Insurance fraud detection is fundamentally a problem of decision-making under uncertainty. An insurer rarely observes fraud directly at the time a claim is submitted. Instead, it observes partial evidence: the timing of a loss, the claimant’s history, repair estimates, medical records, policy characteristics, geographic information, and inconsistencies in statements. Statistical risk models convert this evidence into estimates of probability, expected severity, or expected financial loss.

A fraud score is not, by itself, a finding of fraud. It is an analytical signal that helps determine whether a claim should receive routine processing, additional verification, specialist review, or investigation. The quality of such a system depends not only on predictive power but also on calibration, sampling design, data quality, governance, explainability, and the consequences of errors.

This chapter develops the statistical foundations required to estimate fraud propensity, claim severity, and expected loss. It connects probability, sampling, Bayesian reasoning, regression, credibility theory, time-series methods, and loss distributions with operational fraud scoring. It also examines uncertainty, model validation, ethical safeguards, and the practical use of analytics in insurance organizations.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain probability-based approaches to insurance fraud detection.

2. Distinguish fraud propensity, claim severity, frequency, and expected loss.

3. Apply Bayesian reasoning to update fraud probabilities as evidence changes.

4. Interpret logistic, count, severity, and survival-oriented regression models.

5. Explain credibility theory and its relevance to sparse or heterogeneous claims data.

6. Use sampling, time-series methods, and loss distributions appropriately.

7. Evaluate discrimination, calibration, uncertainty, and operational thresholds.

8. Identify ethical, regulatory, governance, and implementation risks in fraud scoring.

From Suspicion to Quantified Risk

Let F denote the event that a claim is fraudulent and X represent the available evidence. A basic fraud model estimates:

P(F | X),

which is the probability that a claim is fraudulent given its observed characteristics. This differs from P(F), the overall or prior fraud prevalence. A claim may possess several suspicious indicators while still having a low absolute probability of fraud if actual fraud is rare.

Three related quantities must be separated:

• Fraud propensity: the probability that a claim is fraudulent.
• Claim severity: the financial amount associated with a claim, whether fraudulent or genuine.
• Expected loss: the probability-weighted financial consequence, often expressed as P(F | X) multiplied by the estimated incremental loss attributable to fraud.

A claim with a high fraud probability but a very small financial value may deserve less immediate investigative attention than a moderately suspicious claim involving substantial potential overpayment. Consequently, operational prioritization often uses an expected value framework:

Expected investigative value = estimated recoverable or avoidable loss − cost of investigation.

This framework encourages insurers to distinguish statistical suspicion from managerial priority.

Probability, Sampling, and the Base-Rate Problem

Probability models require a clear understanding of the population from which data are drawn. In insurance, available fraud data are rarely a simple random sample. They may consist of cases referred by adjusters, claims already investigated, or matters confirmed through legal or administrative processes. Such data can substantially overrepresent suspicious claims.

Suppose the true fraud prevalence is 2 per cent. A screening model has 90 per cent sensitivity and 90 per cent specificity. In a population of 10,000 claims, approximately 200 are fraudulent; the model identifies 180 of them. However, it also incorrectly flags about 980 genuine claims. Thus, only 180 of the 1,160 flagged claims are fraudulent, producing a positive predictive value of approximately 15.5 per cent. This illustrates the base-rate problem: even a seemingly accurate model may generate many false positives when the event is uncommon.

Sampling methods influence both model estimation and performance evaluation. Common approaches include:

• Simple random sampling, in which each observation has an equal selection probability.
• Stratified sampling, in which claims are sampled separately by product, geography, value, or claim type.
• Case-control sampling, in which confirmed fraud and non-fraud cases are deliberately balanced for model development.
• Temporal sampling, which preserves the chronological order needed to test future performance.
• Cluster sampling, useful where claims are grouped by branch, provider, repairer, or organized network.

When the development sample does not reflect operational prevalence, predicted probabilities must be corrected or recalibrated. A model trained on a 50:50 fraud/non-fraud sample cannot automatically be interpreted as producing real-world probabilities when fraud prevalence is 2 per cent.

Bayesian Reasoning in Claims Investigation

Bayesian reasoning provides a disciplined method for updating beliefs as evidence accumulates. Bayes’ theorem is:

P(F | E) = [P(E | F)P(F)] / P(E),

where P(F) is the prior probability of fraud, P(E | F) is the likelihood of observing evidence E if fraud exists, and P(F | E) is the posterior probability after considering the evidence.

Odds form is often more intuitive:

Posterior odds = Prior odds × Likelihood ratio.

If a claim has a prior fraud probability of 2 per cent, its prior odds are 0.02/0.98, or approximately 0.0204. Suppose an evidence pattern has a likelihood ratio of 5. The posterior odds become 0.102, corresponding to a posterior probability of approximately 9.3 per cent. The evidence increases concern, but it does not establish fraud.

Bayesian thinking is valuable because individual indicators are rarely conclusive. A late-night loss report, a recent policy increase, and a claimant’s prior history may each provide modest information. Their combined effect depends on whether they are independent, overlapping, or generated by the same underlying circumstance. Treating correlated indicators as independent can produce excessive confidence.

Bayesian networks can represent relationships among policy inception, loss timing, claimant behaviour, documentation, and provider relationships. They are particularly useful when expert knowledge and incomplete evidence must be combined. Their limitations include dependence on assumptions, difficulty of validation, and the risk that subjective priors encode organizational bias.

Regression Models for Fraud and Loss Estimation

Logistic regression for fraud propensity

The standard logistic model estimates the log-odds of fraud:

log[p/(1 − p)] = β0 + β1X1 + β2X2 + … + βkXk.

Here p is the estimated probability of fraud. A coefficient βj represents the change in log-odds associated with a one-unit increase in Xj, holding other variables constant. The quantity exp(βj) is an odds ratio.

Logistic regression is attractive because it is interpretable, computationally efficient, and suitable for governance. Its assumptions include a correctly specified relationship between predictors and log-odds, appropriate treatment of interactions, and adequate handling of missing data. Non-linearity can be addressed with transformations, splines, or carefully selected categories.

Count and frequency models

Fraud events, referrals, or claims may be modeled as counts. Poisson regression is appropriate when the conditional mean and variance are approximately equal. Insurance data often exhibit overdispersion, in which case negative binomial regression may be preferable. A zero-inflated model can be considered when there are more zero observations than a standard count process would predict, although such models should not be used merely because they improve fit without a sound substantive explanation.

Severity models

Claim amounts are usually positive, skewed, and heteroscedastic. Generalized linear models using a Gamma distribution with a log link are common for positive severity. Lognormal models may also be useful when the logarithm of claim cost is approximately normal. Large losses may require separate treatment because their tail behaviour differs from ordinary claims.

A two-part model can be used when many claims have zero incremental fraud loss and positive losses are highly skewed. The first part estimates the probability of a positive loss, while the second estimates the amount conditional on a positive loss.

Expected loss models

Fraud-related expected loss can be decomposed as:

E(L | X) = P(F | X) × E(L | F, X),

where L is the relevant fraudulent or avoidable loss. More complete models may include the probability of detection, recovery rate, investigation cost, and operational delay. Combining separate models requires attention to consistent definitions and uncertainty propagation.

Credibility Theory and Sparse Evidence

Credibility theory balances an individual risk’s own experience with broader portfolio information. This is important in fraud analytics because many claimants, providers, policies, or small commercial accounts have limited histories.

A simple credibility estimator is:

Estimate = Z × individual experience + (1 − Z) × collective experience,

where Z ranges from 0 to 1. A high Z is justified when data are numerous, reliable, and relevant. A low Z is appropriate when observations are sparse or volatile. Limited-fluctuation credibility determines the volume of observations required for a specified level of confidence, while greatest-accuracy credibility uses statistical variance and structural assumptions.

In practice, credibility prevents extreme scores based on a single unusual event. A repairer with one suspicious claim should not necessarily be treated like a provider with a sustained and independently supported pattern. Hierarchical or multilevel models extend credibility by allowing provider, branch, region, and product effects while shrinking unstable estimates toward the overall mean.

Time-Series Methods and Emerging Fraud Patterns

Fraud is not static. Organized activity may appear as a temporary surge, migrate geographically, or follow changes in regulation, economic conditions, repair prices, or digital claims processes. Time-series methods help separate ordinary seasonality from unusual activity.

A basic decomposition expresses an observed series as trend, seasonal component, cyclical movement, and irregular error. Moving averages and exponentially weighted averages are useful for operational monitoring. More formal approaches include autoregressive integrated moving average models, state-space models, and intervention analysis.

For example, a sudden increase in claims from a provider may reflect seasonal demand, a new marketing campaign, or genuine coordinated fraud. A time-series model can estimate the expected number of claims and identify residual deviations. Control charts may then signal when observations exceed statistically plausible limits.

Time leakage is a serious modeling error. Information created after a claim decision—such as an investigation outcome, later legal finding, or final settlement—must not be used as a predictor for an earlier operational score. Validation should mimic the future deployment environment through rolling or out-of-time testing.

Loss Distributions and Tail Risk

Insurance losses are commonly modeled using frequency and severity distributions. Frequency may follow Poisson or negative binomial forms, while severity may follow Gamma, lognormal, Weibull, Pareto, or other heavy-tailed distributions. Aggregate loss is then the sum of individual claim severities over a period.

Fraud-related losses may have a particularly heavy tail because organized schemes can generate repeated or high-value claims. Quantities such as Value at Risk and Conditional Value at Risk can support capital, reserve, and investigation planning. Value at Risk identifies a percentile threshold, whereas Conditional Value at Risk estimates the expected loss beyond that threshold. Tail estimates are highly sensitive to sparse observations and model assumptions; they should therefore be accompanied by confidence intervals and sensitivity analysis.

Mixture distributions can distinguish ordinary claims from a latent high-risk segment. However, a statistical mixture should not automatically be interpreted as proof of separate criminal groups. It is a description of patterns requiring operational investigation.

Constructing, Calibrating, and Using Fraud Scores

A practical scorecard commonly follows these stages:

1. Define the decision, such as referral, manual review, or payment control.

2. Specify the unit of analysis and the outcome window.

3. Assemble predictors available at the moment of decision.

4. Develop and validate the model using appropriate sampling and temporal separation.

5. Convert predicted probabilities into a score or risk band.

6. Choose thresholds using investigation capacity, costs, and error consequences.

7. Monitor performance and recalibrate as behaviour changes.

Discrimination measures whether a model ranks risky cases above less risky cases. The area under the receiver operating characteristic curve is widely used, but it can appear strong even when probabilities are poorly estimated. Precision-recall analysis is often more informative for rare fraud events.

Calibration assesses whether predicted probabilities correspond to observed frequencies. If claims assigned a 20 per cent probability are fraudulent only 8 per cent of the time, the model is overconfident. Calibration plots, calibration intercepts and slopes, and the Brier score are useful tools. Recalibration may involve adjusting the intercept, applying logistic recalibration, or using isotonic methods.

Thresholds should reflect the cost of false positives and false negatives. A false positive can delay legitimate payment, burden investigators, and damage customer trust. A false negative can produce financial loss and allow organized fraud to continue. Threshold selection should therefore be a governance decision supported by quantitative analysis, not an arbitrary score cut-off.

An Illustrative Case: Motor Claims Referral Model

Background

An insurer receives approximately 40,000 motor claims annually. Investigators report that referrals are inconsistent across branches, while confirmed fraud cases are concentrated in a small number of repair networks. The insurer wishes to prioritize claims without automatically rejecting or delaying legitimate claims.

Situation and analysis

Historical data contain confirmed fraud, claims closed without evidence of fraud, and a large group that was never investigated. The analytics team first separates these categories rather than treating uninvestigated claims as certainly genuine. It examines missingness, duplicate records, claim timing, repairer relationships, prior claim frequency, policy changes shortly before loss, and estimated repair cost.

A logistic model is developed using only variables available within 24 hours of notification. Because confirmed fraud is uncommon, the team uses stratified case-control sampling for initial estimation and then corrects the intercept to operational prevalence. A separate Gamma model estimates potential incremental loss for claims with positive suspected overpayment.

Approach and solution

The insurer creates three risk bands. Low-risk claims proceed through ordinary settlement. Medium-risk claims receive targeted document verification. High-risk claims are referred to a specialist unit, but payment is not automatically denied. The expected investigation value combines predicted fraud probability, estimated avoidable loss, recovery likelihood, and investigation cost.

Model performance is assessed on a later time period. The model ranks claims effectively, but initial probabilities are too high in one region because the development sample overrepresented investigated cases. Regional recalibration and monitoring are introduced. Investigators also receive reason codes, such as unusual timing or provider concentration, rather than an unexplained numerical score.

Outcome

The model improves referral consistency and enables investigators to focus on higher-value cases. Review of false positives identifies a legitimate repair network serving a region with unusual weather-related damage. The model is therefore amended to include an event indicator and a temporary monitoring rule rather than permanently penalizing the network.

Learning points

The case demonstrates that statistical scoring is a decision-support system, not a substitute for investigation. Sampling correction, temporal validation, calibration, human review, reason codes, and feedback from false positives are essential. It also shows why a high ranking score does not establish fraudulent intent.

Limitations, Risks, and Common Errors

Several errors can undermine statistical fraud analytics. Label bias occurs when only referred claims are investigated, making the target reflect past human suspicion rather than actual fraud. Confirmation bias may arise when analysts select predictors because they appear intuitively suspicious. Data leakage produces deceptively high validation results. Correlated variables can exaggerate evidence, while unstable small samples can create extreme coefficients.

Concept drift occurs when fraud methods, products, economic conditions, or operational procedures change. Population shift occurs when the composition of claims differs between development and deployment. Fairness risks arise when geographic, socioeconomic, language, or demographic proxies cause disproportionate scrutiny of particular groups.

Models may also fail operationally. Investigators may receive too many referrals, scores may not be integrated into workflow, or staff may treat a probability as a conclusion. Performance metrics should therefore include investigator capacity, review time, customer impact, recovery value, and complaint rates, not merely statistical accuracy.

Governance, Ethics, and Professional Responsibility

Fraud analytics must comply with applicable insurance, privacy, consumer-protection, anti-discrimination, and data-governance requirements. Organizations should document the purpose of processing, lawful data use, retention rules, access controls, and procedures for correcting inaccurate information.

A defensible model governance framework includes model ownership, independent validation, version control, approval thresholds, monitoring, override procedures, audit trails, and periodic review. Customers should not be denied solely because an opaque model assigns a high score, especially where adverse decisions have significant consequences. Human review should be meaningful rather than a ceremonial confirmation of automated output.

Explainability does not require revealing every technical detail to every user. It does require that investigators and decision-makers understand the principal factors influencing a score, the score’s limitations, and the distinction between risk estimation and proof. Sensitive attributes and their proxies require particular scrutiny.

Technology and Emerging Developments

Modern insurers increasingly combine structured claim data with text analytics, graph methods, digital images, device data, and external information. Graph analytics can identify dense relationships among claimants, vehicles, repairers, addresses, medical providers, and bank accounts. Natural language processing can detect inconsistent descriptions or repeated narrative templates. Computer vision may compare damage photographs with repair estimates, although image quality and adversarial manipulation remain concerns.

Machine-learning methods such as gradient boosting and neural networks may improve ranking performance, but they require stronger controls for explainability, drift, reproducibility, and fairness. Hybrid systems often combine interpretable statistical models with machine-learning components and rules developed by investigators. Continuous monitoring, champion-challenger testing, and privacy-preserving data practices are likely to become more important as automated claims ecosystems expand.

Best Practices for Professional Use

Effective fraud scoring should follow several principles:

• Define fraud and the decision objective precisely.
• Preserve the chronological information available at the point of decision.
• Correct for biased samples and changing prevalence.
• Separate probability, severity, and expected financial value.
• Assess both discrimination and calibration.
• Use credibility methods where individual histories are sparse.
• Validate on later periods and relevant subgroups.
• Provide reason codes and an appeal or review pathway.
• Monitor drift, fairness, false positives, and operational outcomes.
• Treat models as evolving governance-controlled systems rather than permanent formulas.

Chapter Summary

Statistical fraud detection estimates uncertain outcomes rather than proving fraud. Probability and Bayesian reasoning explain how prior prevalence and evidence combine. Sampling design is central because confirmed or investigated claims rarely represent the full portfolio. Logistic regression estimates fraud propensity, while count, severity, and two-part models estimate frequency and financial consequences. Credibility theory stabilizes estimates where individual experience is limited. Time-series methods identify emerging or abnormal patterns, and loss distributions support analysis of skewed and heavy-tailed fraud losses.

A useful fraud score must be calibrated, operationally relevant, and governed. Discrimination measures ranking ability, whereas calibration measures whether predicted probabilities are trustworthy. Thresholds should consider investigation capacity, financial value, and the costs of false decisions. Ethical and professional use requires privacy protection, explainability, human oversight, monitoring, and safeguards against unfair treatment. The most reliable systems combine statistical discipline with investigative judgment and continuous organizational learning.

Key Terms

Bayesian updating: Revision of a probability after incorporating new evidence.

Calibration: Agreement between predicted probabilities and observed event frequencies.

Credibility theory: A method that blends individual experience with collective portfolio experience.

Expected loss: The probability-weighted estimate of financial loss.

False negative: A fraudulent claim incorrectly classified as non-fraudulent.

False positive: A genuine claim incorrectly flagged as suspicious.

Fraud propensity: The estimated probability that a claim is fraudulent.

Likelihood ratio: The relative probability of observed evidence under two competing hypotheses.

Loss distribution: A probability distribution describing insurance loss amounts or frequencies.

Model drift: Decline in model relevance caused by changes in behaviour, data, or environment.

Odds ratio: The multiplicative change in odds associated with a predictor.

Prior probability: The probability assigned before considering new evidence.

Precision: The proportion of flagged cases that are genuinely positive.

Severity: The monetary amount associated with a claim or loss.

Sensitivity: The proportion of actual positive cases correctly identified.

Specificity: The proportion of actual negative cases correctly not flagged.

Time leakage: Use of information unavailable at the time a prediction should have been made.

Value at Risk: A loss threshold corresponding to a specified probability percentile.

Review Questions

Short Answer Questions

1. Distinguish fraud propensity from expected loss.

2. Why does a low fraud base rate create many false positives?

3. What is the purpose of credibility theory in fraud analytics?

4. Define calibration and explain why it matters.

5. What is time leakage in model development?

Long Answer Questions

1. Explain how Bayesian reasoning can be applied to insurance claim investigation.

2. Compare logistic regression, severity models, and two-part models in fraud analytics.

3. Discuss the importance of sampling design and prevalence correction.

4. Explain how time-series and loss-distribution methods support fraud risk management.

5. Describe a complete governance framework for an operational fraud-scoring model.

Analytical / Application Questions

1. A portfolio has a 2 per cent fraud rate, and a screening model has 90 per cent sensitivity and specificity. Calculate the approximate positive predictive value and interpret the result.

2. A claim has a prior fraud probability of 2 per cent and evidence with a likelihood ratio of 5. Use odds-form Bayesian reasoning to estimate the posterior probability.

3. An insurer’s model ranks claims well but consistently overstates probabilities in one region. Identify possible causes and recommend a validation and recalibration strategy.

22. Multiple Choice Questions with Answers

Question 1

Which quantity directly represents the probability that a claim is fraudulent given its observed characteristics?

A. P(F)

B. P(F | X)

C. P(X | not F)

D. E(L | F, X)

Correct Answer: B. P(F | X)

Question 2

Why can a model with high sensitivity and specificity still produce many false positives in fraud detection?

A. Fraud claims always have low severity

B. The model has no predictors

C. Fraud is often a low-base-rate event

D. Specificity measures the fraud rate

Correct Answer: C. Fraud is often a low-base-rate event

Question 3

A prior fraud probability is 2 per cent and evidence has a likelihood ratio of 5. What is the approximate posterior probability?

A. 2.0 per cent

B. 5.0 per cent

C. 9.3 per cent

D. 25.0 per cent

Correct Answer: C. 9.3 per cent

Question 4

What is the principal purpose of credibility theory?

A. To eliminate all portfolio-level information

B. To blend limited individual experience with collective experience

C. To guarantee that every claim is investigated

D. To replace severity models with rules

Correct Answer: B. To blend limited individual experience with collective experience

Question 5

Which model is most directly suited to estimating the probability of a binary fraud outcome?

A. Logistic regression

B. Gamma regression only

C. Moving average

D. Pareto distribution

Correct Answer: A. Logistic regression

Question 6

What does calibration evaluate?

A. Whether claims are processed quickly

B. Whether predicted probabilities correspond to observed frequencies

C. Whether all variables are normally distributed

D. Whether investigation costs are constant

Correct Answer: B. Whether predicted probabilities correspond to observed frequencies

Question 7

Which practice creates time leakage?

A. Using claim notification time as a predictor

B. Testing on a later period

C. Using a final investigation outcome to score a claim at notification

D. Separating training and validation data chronologically

Correct Answer: C. Using a final investigation outcome to score a claim at notification

Question 8

An insurer wants to estimate positive incremental fraud loss while many claims have zero such loss. Which approach is most appropriate?

A. A two-part model

B. A simple mean without conditioning

C. A seasonal index only

D. A specificity calculation

Correct Answer: A. A two-part model

Question 9

Which measure is especially useful for evaluating ranking performance when fraud is rare?

A. Precision-recall analysis

B. Policy lapse ratio

C. Average claim frequency only

D. Nominal interest rate

Correct Answer: A. Precision-recall analysis

Question 10

What is the most appropriate interpretation of a high fraud score?

A. Fraud has been legally established

B. The claim should automatically be denied

C. The claim warrants risk-based review or further evidence

D. The claimant must be permanently excluded

Correct Answer: C. The claim warrants risk-based review or further evidence