Insurance fraud red flags for claims handlers (2026 guide)

The short version for the claims desk.

• A red flag is a reason to look, not a finding. Every indicator on this list has an innocent twin, and most flagged claims turn out to be honest people with bad photos and a messy story.
• The flags come in five families: timing, the story, documents, photos and video, and behaviour. The dangerous ones are two or more from different families on the same file.
• Triage in three lanes: check what you can verify at your desk today, ask for one more thing, and only then refer. The customer hears about timing, never about suspicion.
• Written for claims handlers, claims managers and SIU leads at motor and property insurers and claims organisations who review customer-submitted evidence every day.

A motor claim lands on a Tuesday. The photos came in over WhatsApp, the repair invoice is a round £1,500, and the customer's account of the collision has shifted once between the FNOL call and the follow-up email. Nothing here is proof of anything. All of it is on somebody's red flag list.

If you handle claims or run a claims team, that file is your whole week in miniature. UK insurers detected £1.16 billion of fraudulent general insurance claims in 2024, across 98,400 claims, according to ABI figures reported by Insurance Journal. The same data says the largest category by value was not staged crashes or ghost brokers. It was exaggerated loss: £466 million of genuine claims with the numbers pushed up.

That is the grey area this post is about. The flags below are the ones that show up in motor and property files, each with what a fraudster is doing and what an honest customer might be doing that looks identical. Then a triage routine that lets you check without accusing, and a look at why so many photo red flags are produced by the intake channel rather than the claimant.

We wrote this for the claims handler with a referral queue that keeps growing and a complaints inbox that grows with it, and for the SIU lead who gets the referrals. Our team builds Venta Capture, a product of VentaVid: a guided capture link the claimant opens on their own phone, so the evidence arrives structured, timestamped on receipt and sealed, with signals a handler can read instead of guess at. If your team is still asking for photos by WhatsApp, start for free and send one capture link on the next motor claim.

A red flag is a reason to look, not a finding

Barry Zalma, who has written the standard US texts on claims fraud, puts it in four words: "red flags are not evidence". His rule is that three or more on one file should be discussed with a supervisor and the SIU.

The most-read checklist in the search results sets the bar at two from different categories. Either way, the unit of suspicion is the combination, never the single flag.

Most of what your red flag list catches is a true loss with a false number attached, which is why a checklist used as a verdict does more harm than good. The ABI's £466 million of exaggerated loss is bigger than its property fraud total. Those files start with a real collision, a real leak, a real burglary. The story, the police report and most of the photos are genuine. Only the invoice, or the list of contents, has been stretched.

The industry calls the person who does that an opportunistic fraudster: not connected to a ring, just someone who saw a chance.

And the line they crossed is blurrier than a handler might assume. In Verisk's March 2026 study of 1,000 US consumers, 36% said they would consider digitally altering a claim image, and 52% thought adjusting brightness or contrast to make damage easier to see was acceptable. Only 15% called exaggerating damage acceptable. Most people who touch a claim photo think they are helping.

So the list below does two things at once. It names the flag, and it names the innocent version, because the second column is what keeps a handler from turning a customer into a suspect on a hunch.

Where I cite a number it carries a source; the flags themselves come from regulator and industry indicator lists, from Zalma's, and from what we see building the signals layer of a capture product, where the same question comes up daily: what does this artefact prove, and what else could have caused it? For the full numbers behind the problem, our AI insurance fraud statistics page collects them with sources.

The red flags, family by family, with their innocent twin

Five families. Read each one as a pair of columns, not a single list.

Timing

Timing flags are the cheapest to check and the easiest to over-read.

The ACFE adds two motor-specific coverage flags worth a policy check: a vehicle recently added to the policy, and first-party cover placed on an older vehicle where a comprehensive deductible sits lower than the collision one. Both take a minute to verify and neither means anything alone.

The story

Story flags live in the difference between the FNOL call, the written statement and the photos.

• The timeline moves. Time of loss, who was driving, which room the water came from: if it changes between tellings, note it. The innocent version is shock, a poor memory for clock times, a second language, or a family member who filed on the customer's behalf and got it slightly wrong.
• Severity grows. A "small scrape" becomes a "write-off" by the second call; every occupant of a low-speed shunt reports whiplash. The innocent version is that pain and damage both look worse on day three than on day one.
• No witnesses, no police report, or a report filed days later. Common in staged accidents and in fabricated thefts. Also common when a customer did not know a report was needed, or the police were not interested.
• "Everything was in that room." The high-value contents all sat in the room that flooded or burned. Sometimes true: the study, the garage, the spare room where the boxes were.
• The story is too tidy. A statement that reads like a claim form knows what it needs to say. Or the customer had a previous claim and learned from it.

Documents

Document flags are objective, which is why the top-ranked checklists rate them highest. They are also where honest paperwork looks worst.

• Round-number invoices and estimates. £1,500 exactly, twice, from the same repairer. Small garages and builders quote in round numbers all the time.
• Template documents. Same font, same layout, same phrasing across unrelated claims. Or the same estimating software used by every body shop in the region.
• Receipts that pre-date the loss, or post-date it by a suspicious margin. A replacement-value receipt for a ten-year-old television. Or a customer who bought the replacement before you had agreed the claim because they needed one.
• The same supplier on many files. A repairer, a contractor or a hire company that keeps appearing. Sometimes a ring; sometimes just the busiest garage on the road.
• Mismatched details across documents. Address, vehicle registration or dates that do not agree. Or a typo, a house move, a private plate transfer.

Two document checks are cheap and decisive enough to run before anything else: does the estimate match the damage in the photos, and does the supplier exist at the address on the invoice. Our guide to insurance claim documentation covers what a complete file contains, which is the baseline you are comparing against.

Photos and video

This is the family where the checklists do the most damage, because every flag has a technical cause that has nothing to do with honesty.

A 2023 Claims Journal viewpoint on digital deception in claim photos names four vectors that hold up well: metadata inconsistencies, image duplication, internet sourcing and pixel manipulation. Its examples are the ones to remember: burn photos downloaded from a hospital website and filed as a real injury, and a property appraiser who reused photos across 170 claims over two years for around $1 million in indemnity.

The checklists leave one thing out. Missing metadata on its own tells you which channel the photo came through, not whether the claimant is honest. A photo forwarded from WhatsApp has no EXIF data because WhatsApp removed it. A screenshot never had any.

If your intake accepts those, most of your honest files carry the flag too, and the flag stops meaning anything. The edited-photo cases are real, and they are the subject of our posts on shallowfake claims and AI-generated insurance fraud. But the way to catch them is to know how the photo was made, which we come back to below.

Behaviour

Behaviour flags are the most subjective, so they carry the least weight on their own.

• Pressure for a fast cash settlement. Wants money, not repairs, and wants it this week. Or is broke and needs the car for work by Monday.
• Refuses or dodges inspection. Cancels the engineer twice, the car is "with a friend". Or works shifts and has no way to get the car to you.
• Unreachable, then aggressive. Or overwhelmed and angry at a process nobody explained.
• Counsel on day one. Or a customer who was burned by an insurer before and is not doing that again.
• Knows the process too well. Uses the vocabulary, anticipates the questions. Or has made two honest claims and paid attention.
• Insists on one specific repairer. Possibly a partner in the scheme. Possibly the garage that has serviced the car for a decade.

Motor and property: the same flag, a different meaning

Motor is where most detected fraud sits: 51,700 detected motor claims worth £576 million in 2024, 53% of the UK total. Property was smaller, 18,700 claims worth £189 million, but its count rose 11% in a year. Both lines run on customer photos, and the same flag reads differently on each.

The honest versions on the right-hand side are everyday. A motor handler who treats "photographed at home" as a flag will flag most of their book, because most people drive home before they think about photographs. The two columns are there to remind you what the base rate looks like.

How to triage a red flag without accusing anyone

The failure mode is not missing fraud. It is stalling honest claims on suspicion nobody can articulate, then explaining that to a complaints team and later to an ombudsman. Insurers know it: in the Verisk study, 35% named false positives as a challenge and 44% still rely on manual review to catch manipulated media.

A red flag should cost the customer nothing they would notice, until the moment two families of flags line up on the same file. Three lanes, in order.

1. Desk check now. Everything you can verify in minutes without contacting the customer: policy inception and cover changes, prior claims, whether the repairer exists at the invoice address, whether the estimate matches the damage in the photos, the weather on the date of loss, and a reverse image search on the main photo. Most timing and document flags clear or harden here.
2. Ask for one more thing. A capture of the damage as it is now, the registration plate and the odometer in the same frame, the room from the doorway, the serial number on the appliance. Ask everyone at this stage, not only the flagged files, and say why: "we need this to progress the claim". The request is a normal step, so the customer never learns they were a question mark. A photo flag that came from the channel disappears the moment a proper capture arrives; a photo flag that came from the claimant does not.
3. Refer. Two flags from different families that survived lanes one and two, or one hard flag: an image found online, an image on another file, a document with edit traces, a supplier that does not exist. Write the referral as facts and artefacts, not impressions. The SIU can act on "the invoice address is a residential flat and the same PDF template appears on two other files"; it cannot act on "felt off".

Throughout, the customer hears about timing and next steps. They never hear the word fraud from a handler, because the handler is not the one who decides.

That discipline is also the difference between a claims triage routine that speeds up the honest majority and one that slows everything to protect against the rest. Cycle time is the other cost of over-flagging, and our post on reducing claims cycle time walks through where the days go.

If lane two is where your team spends its afternoons, chasing re-sends over WhatsApp, book a demo and we will show what "one more thing" looks like as a guided link instead.

Most photo red flags are made by the intake channel, not the claimant

Go back to the photo table. Missing capture data, wrong dates, re-saved files, gallery images of unknown origin, screenshots: "send us some photos" over WhatsApp, email or a portal upload manufactures every one of those artefacts, on honest claims and dishonest ones alike. Then the handler is asked to read them as evidence.

When the organisation decides how the evidence gets created, a whole class of red flags stops appearing, and the ones that remain mean something. That is what a guided capture flow does. The claimant gets a secure, personal capture link at FNOL, opens it in the phone's browser with nothing to install, and follows the steps your team wrote: the plate, the four corners, the damage close and wide, the odometer, the room from the doorway, then a yes/no question that steers what comes next. Each step has an example photo and a plain instruction. The remote claim inspection flow on the Venta Capture site shows the shape of it.

Then the mechanics that replace guesswork:

• Recorded in the session, on the phone's camera. An item captured through the flow is labelled as taken via Venta Capture. If your form allows an extra upload (the customer already had a photo from last night), that file is labelled "Provenance: Not verified" and checked on its metadata, editing traces and whether it already exists online, with a plain-language note on what those checks can and cannot prove.
• A server receipt time. It proves when the system received the submission. It does not prove when the damage happened, and the product says so on the page rather than letting a timestamp imply more than it can.
• A location prompt. Recorded when given. When the claimant declines, the case says so and records it as neutral, never as a strike against them.
• A SHA-256 fingerprint per file and a signed seal with a manifest that can be verified outside the platform, plus a session timeline. The product page counts more than 25 control points per submission. That is the sealed submission a reviewer can stand behind a year later.
• Signals, not verdicts. Submissions are scored green, orange or red against a named, versioned rule set your team configures: recording attempts, a file arriving instead of a session recording, virtual-camera software present, a device or network seen on an earlier submission, a sealing failure. Every signal carries its own caveat in the interface, because several attempts is normal behaviour, a shared family phone produces reuse, and IP ranges are shared. Orange means look closer, red means ask for a new capture before proceeding, and a person makes the call. The fraud signals page lists them.
• Retake in one click. The customer gets a fresh link, is asked why they are recording again, and the new case is linked to the original. That is lane two of the triage, built in.

What this does not do is settle the grey area entirely. A genuine leak can still come with an inflated contents list, and a real recording can still show a staged scene. The story and the numbers still need a handler.

What changes is that the question "is this photo even the photo" mostly goes away, so the handler's attention goes to the flags that deserve it. The broader case for guided evidence is in our photo evidence for insurance claims post; the guided video capture page explains how a flow is built.

You can build that first motor or property flow yourself on the free plan. Start for free, send the link on the next ten claims, and count how many photo flags survive.

Frequently asked questions

What are the most common insurance fraud red flags in motor claims?

Timing near a cover change or lease end, a story that shifts between the FNOL call and the statement, round-number repair invoices, photos with no capture data or taken somewhere other than the scene, and pressure for a fast cash settlement. None is proof alone; two from different families on the same file is the usual referral trigger.

What are the red flags in a property insurance claim?

A loss shortly after contents cover was raised, high-value items all in the one damaged room, replacement receipts that pre-date the loss, photos forwarded from a family chat with no capture data, and a builder's estimate in round numbers. Each has an everyday explanation, so verify before you refer.

How many red flags before a claim goes to the SIU?

Barry Zalma's rule is three or more, reviewed with a supervisor and the SIU. Widely used checklists set it at two from different categories. A single hard flag, such as an image found online or on another claim, can justify a referral on its own.

Does missing photo metadata mean the claim is fraudulent?

No. WhatsApp, email and most portals strip EXIF data, and a screenshot never had any, so most honest customer photos arrive without it. Missing metadata tells you the channel; only a capture recorded in a controlled session can tell you when and on what device a photo was taken.

How do I check a suspicious claim without accusing the customer?

Verify what you can at your desk first (policy dates, prior claims, the supplier, estimate versus photos), then ask for one more capture as a normal step you ask of everyone. Refer only when flags survive both stages, and write the referral as facts. The customer hears about timing, never about suspicion.

What is the difference between opportunistic and organised insurance fraud?

Opportunistic fraud is an ordinary customer inflating a genuine loss or bending an application; the ABI's largest category by value, exaggerated loss, is mostly this. Organised fraud is rings running staged collisions, ghost broking or fake suppliers. The red flags overlap, but organised fraud shows up as patterns across files rather than inside one.

Can software detect insurance fraud from photos?

Software can surface signals: whether a photo was recorded in a controlled session, when the server received it, whether the file shows editing traces or already exists online, and whether the device was seen before. Those are reasons to look, not verdicts. The decision stays with a handler or investigator.

Talk to us

If your referral queue is full of claims that were flagged on one photo and one hunch, run the triage above on the next twenty and count how many clear in lane one. Then look at how many photo flags your intake channel is creating for you. That second number is the one a guided capture link removes.

What it takes to start.

• Free plan, no credit card, and you can be live in 10 minutes with a first motor or property flow.
• Nothing for the claimant to install: the link opens in the browser their phone already has.
• Stuck? Book a free setup call and we build your first flow together.

Venta Capture is built by the VentaVid team, which has spent over a decade putting video into sales, service and claims workflows for teams in 43 countries.

Start for free and send your first capture link today, or book a demo and we will map it to your FNOL flow.