What Is a Special Investigations Unit (SIU)? How Insurance Fraud Investigation Works

TL;DR

• An SIU is a mandatory, regulated investigative unit inside a carrier's claims operation that handles suspected fraud referrals, not routine claim adjustment.
• A claim reaches the SIU when red flags surface: policy freshness, suspicious claim timing, prior claim history, provider anomalies, or inconsistent statements. Referrals come from both automated triggers and adjusters.
• Investigators combine surveillance, medical canvassing, background checks, examinations under oath, and open-source intelligence. No single method carries a case.
• State insurance departments audit SIUs through market conduct exams, scrutinizing referral rates, case closure documentation, training records, and fraud reporting timeliness.
• High-performing SIUs track referral-to-closure ratio, time-to-investigate, and caseload per investigator. Outreach-heavy tasks like canvassing usually create the throughput bottleneck.

What an SIU Is — and Why Every Major Carrier Has One

A Special Investigations Unit is the team inside a carrier's claims operation that investigates suspected fraud, and in most states it exists because the law requires it. The National Association of Insurance Commissioners published a model regulation in 1995 that established the template most states adopted. That model defines the unit's statutory purpose. An SIU detects, investigates, and reports suspected fraudulent insurance acts to the appropriate state authority. Carriers do not run SIUs because they want a fraud team. They run them because their license to write business in a given state depends on it.

The unit's mandate separates it cleanly from the rest of the claims department. A standard adjuster evaluates coverage, sets reserves, and pays legitimate claims as efficiently as the policy allows. Speed and customer satisfaction drive that work. SIU investigators operate on the opposite incentive. When a claim shows indicators of fraud, the adjuster refers it out of the normal adjustment track and into the SIU, where an investigator builds a factual record that either confirms or clears the suspicion.

That handoff matters because the two functions answer to different standards. An adjuster who pays a fraudulent claim costs the carrier money. An adjuster who delays a legitimate claim to chase a hunch creates bad-faith exposure and regulatory risk. The SIU exists precisely so the adjuster does not have to make that call alone. The investigator absorbs the cases that warrant scrutiny, applies investigative methods the adjuster has neither the time nor the authority to use, and documents the outcome to a standard that holds up in a coverage dispute or a referral to law enforcement. Every major carrier maintains one because the regulatory floor leaves no choice, and because the cost of unchecked fraud dwarfs the cost of staffing the unit.

The Regulatory Framework Governing SIUs

Most SIU obligations trace back to the NAIC Special Investigations Unit Model Regulation, which sets the baseline most states adopted in some form. The model regulation requires carriers above a certain premium threshold to maintain an SIU or contract the function out, establish written antifraud procedures, and train claims staff to recognize fraud indicators. Read it as the floor every carrier has to clear, not a ceiling on what states can demand.

States then layer their own rules on top, and four of them set the tightest standards. California requires insurers to file an annual antifraud plan with the Department of Insurance and report suspected fraud to the Fraud Division. Florida mandates a dedicated SIU or an approved third-party arrangement, plus specific staffing ratios tied to claim volume. New York and Texas both impose written fraud plans subject to regulator approval, and New York requires a full-time SIU for larger carriers rather than allowing the function to be split across part-time adjusters. If you operate across these states, you build to the strictest requirement and apply it everywhere, because maintaining four separate compliance postures costs more than meeting one high bar.

Two obligations flow directly from this framework, and your operations leaders should treat both as non-negotiable. The first is a mandatory referral procedure. You need a documented, repeatable process that routes claims with fraud indicators to the SIU, and regulators will ask to see the written version during an exam. An informal practice where adjusters refer cases at their own discretion does not satisfy the requirement.

The second obligation is annual fraud reporting to the state insurance department. Each state defines its own format and deadline, but the substance is consistent. You report the volume of suspected fraud referrals, the cases you forwarded to law enforcement or a fraud bureau, and the outcomes you can document. Miss the filing deadline or submit incomplete numbers, and you create the kind of finding that turns a routine market conduct exam into a corrective action plan. The reporting cadence is the part most units underestimate until an examiner flags it.

How a Claim Gets Referred to the SIU

A claim reaches the SIU through one of two doors, and most carriers run both. The first is the automated trigger built into the claims management system, which flags files against rule sets the moment data hits the record. The second is the adjuster who notices something the rules missed and routes the file manually. Both paths matter because a unit that relies on one usually under-detects fraud the other would have caught.

The red flags that trigger referral cluster around timing and history. Policy freshness ranks near the top, since a loss reported days after a policy binds invites scrutiny. Claim timing matters in the same way when a fire, theft, or injury surfaces right before a renewal lapse or right after a coverage increase. Prior claim history feeds the decision too, especially when a claimant has filed similar losses across multiple carriers within a short window.

Provider pattern anomalies catch a different category of fraud. When the same medical clinic, body shop, or attorney appears across an unusual share of a carrier's suspicious files, the pattern itself becomes the referral basis rather than any single claim. Inconsistent statements round out the list. A claimant whose recorded account shifts between the first notice of loss and a follow-up call gives an adjuster a concrete reason to escalate.

Automated triggers handle volume and consistency. A rules engine scores every file the same way at three in the morning, and it never forgets to check prior claim frequency or geographic clustering. The tradeoff is rigidity, because a model tuned to known fraud schemes misses novel ones and generates false positives that waste investigator hours.

Adjuster-initiated referrals fill that gap with judgment. An experienced adjuster reads tone, hesitation, and the small contradictions a system can't parse, and a unit that trains its adjusters to recognize indicators will surface cases no rule set would. The weakness is inconsistency, since referral quality then depends on which adjuster handles the file.

Both pathways shape the referral rate, the metric examiners and claims directors watch most closely. A carrier that leans entirely on automation tends to report a referral rate that mirrors its rule library rather than its actual fraud exposure. One that depends on adjusters sees rates swing with caseload and staffing. Reading the two streams together gives a claims director a far more honest picture of how much fraud the operation is actually catching versus letting through.

What SIU Investigators Actually Do: The Core Investigation Toolkit

No single method proves fraud, which is why SIU investigators run several in parallel and let the findings corroborate or contradict each other. A surveillance video that shows a claimant lifting boxes means little on its own. Pair it with a medical canvass confirming no treatment for the claimed injury and a claims history showing three similar losses across two carriers, and you have a pattern that holds up under scrutiny.

The toolkit below covers the five methods most SIUs rely on. Each produces a different kind of evidence, and each carries its own legal and documentation constraints. A capable investigator knows which method answers which question, and how to sequence them so that one finding directs the next. The sections that follow break down what each method produces and where it falls short.

Surveillance

Field surveillance is the oldest SIU method and the one with the deepest case law behind it. An investigator follows a claimant in public, records video and photographs, and builds a timeline of activity that either supports or contradicts the disability or injury claimed. A claimant who reports a debilitating back injury and then loads heavy boxes into a truck on camera hands you the kind of direct evidence that few other methods produce.

The legal floor for surveillance rests on the public-space doctrine. An investigator may observe and record what any member of the public could see, which covers a claimant walking to a car, working in a front yard, or carrying groceries. The moment surveillance reaches into a fenced backyard, through a window, or onto private property, the evidence risks suppression and the carrier risks an invasion-of-privacy claim.

State rules tighten this further. California and Florida restrict pretextual contact and certain recording methods, and most states require the investigator to be a licensed private investigator. Documentation standards decide whether footage holds up, so the investigator logs date, time, location, and an unbroken chain of custody for every clip.

Surveillance proves what a claimant does on the days you watch. It says nothing about treatment history, prior claims, or financial motive, which is why no competent unit treats it as a standalone case.

Medical Canvassing

Medical canvassing attacks the fraud schemes that depend on a claimant hiding prior treatment. When someone claims a fresh injury that is actually a flare-up of a pre-existing condition, the only way to prove it is to find the earlier treatment record. Canvassing is how investigators locate that record when the claimant has every reason not to volunteer it.

The work starts with geography. An investigator builds a list of providers near where the claimant lives, works, and previously lived. That list runs deeper than primary care physicians. It includes chiropractors, urgent care clinics, physical therapists, imaging centers, and emergency departments where a prior injury might have been treated and never disclosed.

Each provider on that list has to be contacted and asked whether they have ever treated the individual. Most will confirm or deny based on the patient identifiers the investigator supplies. A single confirmation can unravel a claim, because it establishes that the condition predates the loss the claimant is now blaming for it.

Documentation is what makes any of this usable. An investigator records which providers were contacted, what each one reported, and when. A clean chain of confirmations and denials becomes part of the claim file, and it holds up far better than a single positive hit with no record of the surrounding effort.

The catch is volume. A thorough sweep can mean reaching dozens or hundreds of providers per claim, and each contact takes time, follow-up, and patience with front-office staff who screen calls. For a complete operational breakdown of how the sweep gets built and run, see the medical canvassing explainer.

Background Checks and Claims History

Prior claim frequency is usually the first number an investigator pulls, because a claimant filing four total-loss claims across three carriers in two years tells you more in thirty seconds than a week of surveillance. Most investigators start with ISO ClaimSearch, the industry database that aggregates claims across nearly every major carrier. A match in ClaimSearch surfaces patterns no single carrier could see on its own, like the same vehicle reported stolen twice or overlapping injury claims under different policies.

From there, investigators widen the profile. Prior litigation records show whether a claimant has a history of contested claims or staged-loss allegations. Criminal history adds context when fraud connects to organized rings or repeat offenders. Financial stress indicators, such as recent bankruptcies, liens, or lapsed coverage reinstated days before a loss, point to motive in property and auto claims.

None of these signals proves fraud by itself. A person can file several legitimate claims, and financial trouble is not a crime. What investigators build is a pattern, and the strength of the case comes from how the signals stack. Cross-carrier history matters most because it reveals behavior the claimant assumed was invisible. An adjuster looking at one file sees one claim. An SIU investigator running the same claimant through ClaimSearch sees the shape of a career, and that contrast is what justifies deeper scrutiny.

Examinations Under Oath (EUOs)

An examination under oath is a formal, sworn interview the carrier compels the claimant to attend under the policy's own cooperation clause. Defense counsel almost always conducts it, a court reporter transcribes every answer, and the claimant testifies under penalty of perjury. The transcript becomes a fixed legal record the SIU can use long after the interview ends.

The EUO differs from a recorded statement in ways that determine its weight. A recorded statement is an informal phone or in-person conversation an adjuster takes early in a claim, useful but easy for a claimant to walk back later. The EUO locks the claimant into specific facts under oath, so any later contradiction with surveillance footage, medical canvassing results, or background findings exposes the claimant to a perjury problem. That tension is exactly what makes the EUO valuable to an investigator building a case.

SIU managers treat the EUO as both an investigative tool and the foundation for a coverage decision. Inconsistencies between sworn testimony and documented evidence support a referral to a state fraud bureau or law enforcement. A claimant who refuses to attend, or who answers evasively, often hands the carrier a clean coverage defense on the cooperation clause alone. The sworn record is what lets a denial survive a bad-faith challenge later.

Social Media and Digital Investigation

A claimant who reports a disabling back injury but posts video of himself lifting weights gives an SIU investigator a contradiction that no surveillance van can manufacture. Open-source intelligence has become a standard part of the toolkit because public social profiles, geotagged check-ins, and video posts often place the claimant doing exactly what the claim says they cannot. Investigators pull this material to test the claimed loss against the claimant's own published record.

The evidentiary value depends entirely on how it was collected. A timestamped post from a public profile, captured with documented methodology, holds up. The same screenshot pulled through a fake friend request or a logged-in account that bypassed privacy settings invites a challenge that the evidence was obtained improperly. Investigators who violate a platform's terms of service risk tainting the find and handing opposing counsel a reason to suppress it.

Treat collection methodology as part of the evidence, not an afterthought. Record the date, the source URL, the account's public status, and the capture method for every item. That documentation is what turns a damaging post into something an adjuster can rely on for a coverage decision or a referral to law enforcement.

How State Insurance Departments Audit SIU Performance

State insurance departments check your SIU through market conduct exams, and they want proof your unit both opens and closes cases. Examiners pull a sample of referrals and trace each one from intake to disposition. A case that was opened, sat untouched, and quietly closed without a documented outcome reads as a paper SIU. The examiner is looking for evidence that you investigated, reached a conclusion, and recorded why.

Four areas draw the most scrutiny during an exam. Referral rates tell the examiner whether your claims operation is actually feeding suspected fraud to the SIU or burying it. Case closure documentation shows whether investigators reached defensible conclusions instead of letting files age out. Training records confirm your investigators met the hours your state mandates. Fraud reporting timeliness measures whether you sent confirmed cases to the state fraud bureau inside the required window, which several states set in days, not weeks.

Under-referral worries examiners as much as over-referral, and many SIU managers miss this. A unit that refers too many cases looks like it is fishing or stalling legitimate claims. A unit that refers almost nothing looks like it is ignoring fraud to keep claims moving and loss ratios quiet. When an examiner sees a referral rate far below peer carriers writing similar lines, the question becomes whether adjusters are trained to spot red flags at all, or whether referral procedures exist on paper and nowhere else.

The documented outcome is what protects you in the exam room. For every referred case, an examiner wants to see what triggered the referral, what the investigator did, what they found, and what action followed. Closing a case as unsubstantiated is fine when the file shows the work. Closing it with a blank disposition field invites a finding, a corrective action plan, and a follow-up exam. Build your case management so every closure carries a reason code and a narrative, because that record is the difference between passing the exam and explaining yourself to the department twice.

What Separates a High-Performing SIU from an Understaffed One

The difference between an SIU that recovers money and one that just generates activity comes down to three numbers a claims director can pull from any case management system. The first is the referral-to-closure ratio, which tells you how many referrals actually resolve into a documented outcome rather than sitting open until they age out. A unit that opens hundreds of cases but closes a small fraction of them with findings is not investigating fraud. It is building a backlog that eventually gets dismissed for staleness.

The second number is time-to-investigate from the referral date. Fraud cases decay fast. Witnesses forget, providers lose records, and surveillance windows close as claimants settle into routines that no longer reveal the contradiction you were looking for. An SIU that takes weeks to assign a referral has already lost evidence it will never recover, and the longer a suspicious claim stays unworked, the more pressure builds to pay it out just to clear the file.

The third number is investigator caseload per FTE. Most understaffed units fail here in a way that masks the other two metrics. When each investigator carries far more open cases than they can work, the referral-to-closure ratio drops and time-to-investigate stretches, but the cause looks like investigator performance rather than capacity. Track caseload first, because the other two metrics are often symptoms of it.

The bottleneck that caps throughput in high-volume units is rarely the analytical work. Investigators are good at reading patterns and building theories. What slows them down is the outreach. Medical canvassing requires calling every provider in a claimant's area to confirm or deny prior treatment, and claimant history verification means chasing down records across carriers, employers, and prior claims. Both tasks scale poorly because they are labor measured in phone calls and follow-ups, not judgment.

An investigator who spends three days canvassing providers on one case is not surveilling, not preparing an EUO, and not closing the other twelve files on their desk. The work has to happen for the case to hold up, but it consumes the hours that should go toward the parts of the investigation only a trained investigator can do. When you scale referral volume without scaling outreach capacity, the canvassing queue is where investigations stall, and the closure ratio is where it shows up.

Where AI-Powered Outreach Fits in the SIU Workflow

Medical canvassing and claimant history verification stall investigations because they require dozens or hundreds of individual contacts, each made one at a time by an investigator working a phone or a fax queue. A single canvassing sweep across a metro area might mean reaching forty or fifty providers to confirm whether a claimant was treated before the loss date. An investigator handling that manually can clear a handful of contacts a day, which means a sweep that should inform a coverage decision in a week instead drags across a month while the referral sits open.

AI-powered outreach removes that constraint by running the contacts in parallel. Superunit reaches hundreds of providers or claimant contacts simultaneously across phone, text, and email, works each one through callbacks and gatekeepers, and returns a documented response for every attempt. The investigator receives a structured record of who confirmed treatment, who denied it, and who could not be reached, rather than a half-finished call log they have to chase down themselves.

The operational gain shows up directly in time-to-decision on high-volume referrals. When a surge of suspicious claims hits a unit, headcount cannot flex fast enough to absorb the outreach load, and cases queue behind whichever investigator has bandwidth. Outreach capacity that runs independent of headcount clears that queue without forcing a hiring cycle or pulling investigators off case strategy to dial phones. The unit's referral-to-closure ratio improves because the labor-intensive step that used to gate closure now resolves in days.

Superunit is not running the investigation, and it does not replace the investigator's judgment on what a provider's response means for coverage. It handles the outreach and documentation layer, the part that scales poorly with manual labor and most often becomes the bottleneck. For a canvassing sweep or a claimant history check, that means the investigator spends time interpreting confirmed treatment records and building the file rather than working a contact list by hand. The medical canvassing explainer covers how that outreach workflow produces the documented chain an SIU file needs.

Comparison: Manual SIU Outreach vs. AI-Assisted Verification

The contrast becomes clearest when you put manual outreach and AI-assisted verification side by side on the metrics an SIU manager actually tracks.

Conclusion

The regulatory floor for an SIU is well-defined. State mandates set the staffing and reporting requirements, and the NAIC model regulation establishes the baseline every carrier already meets. The investigative toolkit is equally settled. Surveillance, medical canvassing, background checks, examinations under oath, and digital investigation have been refined over decades of fraud defense.

What separates a strong unit from a struggling one rarely comes down to method. The limiting factor is throughput on the labor-intensive tasks that stall investigations, namely the outreach work behind canvassing and claimant history verification. A unit that cannot reach providers and contacts fast enough builds cases slowly, and slow cases close at lower rates.

AI-assisted outreach changes the staffing math on those tasks. Over the next few years, the SIU that scales verification without scaling headcount will close more referrals per investigator, and that gap will widen.

Frequently Asked Questions

What is the difference between an SIU and a claims adjuster?

A claims adjuster evaluates the validity and value of a routine claim and decides what the carrier owes. An SIU investigator takes over when an adjuster or an automated system flags a claim as potentially fraudulent, and runs a deeper inquiry using surveillance, canvassing, and other methods the adjuster never touches. The adjuster keeps claims moving. The SIU determines whether a flagged claim should be paid, denied, or referred to law enforcement.

Is an SIU investigation required by law?

State insurance codes require most carriers to maintain an SIU and to refer suspected fraud to it, but they do not mandate a full investigation on every claim. The obligation is to have referral procedures and a unit capable of acting on them. Whether any specific claim gets a deep investigation depends on the red flags it raises and the carrier's own thresholds.

How long does a typical SIU investigation take?

Most SIU investigations run from a few weeks to several months, depending on claim complexity and how cooperative the parties are. Surveillance, medical canvassing, and scheduling an examination under oath each add time, and a single hard-to-reach provider can stall a file. High-volume units that automate outreach close routine referrals faster because the verification step stops bottlenecking the rest of the work.

What happens after an SIU investigation concludes?

The investigator documents findings and recommends one of three outcomes: pay the claim, deny it on a coverage defense, or refer it to the state fraud bureau or law enforcement. Carriers must report confirmed fraud to the state insurance department, and the documented case file supports any denial that gets disputed. A poorly documented closure is as much an audit risk as no investigation at all.

What is the difference between a soft fraud referral and a hard fraud referral?

Soft fraud involves exaggerating a legitimate claim, such as inflating the value of stolen property or padding an injury claim. Hard fraud involves a deliberately fabricated loss, such as a staged accident or a claim for an injury that never happened. SIUs treat hard fraud referrals as priority cases because they more often support criminal referral and full coverage denial.