Six Degrees of Separation

What would you do with an extra $30 billion? According to the Insurance Information Institute (I.I.I.), that was the annual estimated cost of property/casualty fraud between 2005 and 2009. What's more, I.I.I. estimates that fraud accounts for 10% of the P&C industry's incurred losses and loss adjustment expenses.

With such staggering numbers, it's no wonder that fraud detection is on carriers' minds. Still, it's important to distinguish between opportunistic fraud and organized fraud. The former involves single instances of fraud, while the latter involves collusion between individuals for the specific purpose of driving up claims payouts—and it's the latter that is the focus of many fraud prevention approaches.

Currently, the most common tool for organized-fraud prevention is link analysis. Based on the premise that organized fraud generates a cluster of related claims, investigators look for clusters of connected claims. However, sophisticated criminals are adept at hiding their activity behind multiple degrees of separation. It can be difficult to distinguish innocuous clusters from meaningful ones.

For example, one method of detecting organized fraud is to query all carrier claims data against certain characteristics to identify potentially significant links. That allows investigators to isolate parties that are associated with two or more claims. Unfortunately, this identifies far more clusters than are meaningful, and most are innocuous. It's up to the investigator to refine the data to find the ones that are significant.

Link analysis is a common technique, but it has its limitations. Working from tips and leads is purely reactive and is neither scalable nor reliable. Querying all carrier claims data with the aim of finding a meaningful cluster is labor intensive and time consuming and, arguably, is not the best use of an investigator's skills.

Using techniques like link analysis, carriers have seen nominal success in combating organized fraud. But as savvy, unscrupulous individuals exploit the limitations of these techniques, what can carriers do to better detect and prevent organized fraud?

Though "social network" brings to mind Facebook and Twitter, this investigative method has nothing to do with status updates and hashtags. "Social network" simply refers to the connections between individuals or entities, such as addresses, vehicles or insurance claims. Consequently, automated social network analytics refers to the technique of analyzing those connections for deeper meaning. In the context of fraud detection, it means determining if entities are connected, often through several degrees of separation, to fraudulent claims.

Social network analytics offers the ability to analyze relationships between socially related entities and identify clusters of claims that indicate collusion and organized fraud. But rather than do this using manual, labor-intensive tools, this method uses the power of technology and expanded data sources to automate the process, thereby making the detection of collusion an operational process instead of an investigative process.

As new claims come in, the automated system continuously processes them against the carrier's historical data, looking for clusters, or sets of connected claims, that are related based upon the parties and other entities in the claim (claimants, providers, vehicles, etc.). But this is only part of the process. The automated system also matches those parties and entities to external data—notably, public records data. From this external data, additional relationships can be incorporated; relatives and associates of parties to the claim up to several degrees of separation can be added in. The system then expands the clusters based on this additional data and is able to identify relationships between claims that were not otherwise linked.

At this point, there are far too many clusters to be meaningful or actionable. To address that problem, the system applies filtering and classification algorithms to identify significant clusters based upon information about the characteristics of the clusters and the individuals themselves. The SIU is automatically alerted to these "meaningful" clusters—in other words, to the potentially fraudulent activity.

This approach combats the limitations of current link analysis methods. It removes much of the labor-intensive nature of collusion detection and expands the reach and timeliness of organized-fraud detection, allowing the investigators to take action on a greater range of higher-quality targets. It's an automated, scalable and reliable method for identifying potentially collusive and fraudulent activity.

Furthermore, this approach is proactive. Current methods tend to depend on finding large clusters, or well developed collusion. One major advantage of social network analytics is that it identifies collusion as it is developing, before carriers have paid out the claims.

Automated social network analytics is primarily an operational rather than investigative approach. It offers the ability to:

Automated social network analytics can help carriers significantly reduce claims losses as unscrupulous individuals learn which carriers excel at detecting fraudulent activity. They will take their "business" elsewhere.

As the next step in fraud detection and prevention, automated social network analytics addresses the main limitations of today's link analysis techniques. Analytics-driven alerts reduce the reliance on tips and leads, and systematic processing and filtering of results focuses investigator attention on the individuals and claims that deserve scrutiny.

Including external data in social network analytics can help carriers know what they don't know. The external data enable investigators to identify collusion before it becomes widespread by connecting entities that are otherwise hidden behind multiple degrees of separation.

Social network analytics enables carriers to automatically and systematically identify clusters of interest. Embedded as a component of claims processing, organized-fraud detection becomes part of operations—a proactive, scalable, competitive way of rooting out organized fraud.

John Lorimer is vice president, Analytics Product Management, Insurance, LexisNexis Risk Solutions. Ken Cunningham is vice president and segment general manager, Insurance, LexisNexis Risk Solutions.