Organised ring detection
Graph analysis linking claims through shared people, vehicles, addresses, and providers to expose coordinated fraud rings.
Supporting approachTechnique: Graph Analysis
Organised ring detection changes the unit of review from the individual claim to the network of entities behind it, which is how coordinated fraud becomes visible when each claim in the ring looks ordinary on its own.
The scale can be large: reviewing 2.7 million UK motor claims made over about fifteen months, the Insurance Fraud Bureau identified around 170,000 it believed might belong to suspected organised staged-accident networks.
Research on motor claims found that features drawn from the network of claims, policyholders, brokers, experts, and garages improved a supervised fraud model over claim features alone.
It supports the risk-scoring model rather than replacing it: a claim that scores as low risk individually can still sit inside a high-value ring once it is linked to a repair shop or clinic implicated in other confirmed cases.
The technique lives or dies on entity resolution, since insurance identifiers arrive inconsistently, a claimant’s address gets typed differently across three systems, a repair shop operates under two DBA names, and a phone number gets reused by a new tenant.
It is the wrong tool for one-off exaggeration or a single fabricated claim with no shared entities, where a graph adds cost without adding a lead.
Use it specifically when the concern is coordination: repeat claimants working with the same repair network, staged-accident rings sharing witnesses and vehicles, or provider billing schemes touching many claimants.
Strengths for this problem
- Surfaces coordinated activity, such as the same repair shop, medical clinic, or witness appearing across dozens of otherwise unremarkable claims, that no single-claim review would catch.
- Gives an investigator a concrete lead: the shared entity and every claim it touches, rather than an abstract risk number.
- Gets more valuable as more claims are connected, since a ring that looks like isolated noise in one line of business becomes obvious once auto, property, and injury claims are linked by shared addresses and phone numbers.
Limitations for this problem
- Depends entirely on entity resolution across people, vehicles, addresses, phone numbers, bank accounts, repair shops, and medical providers; a missed match hides a ring and a false match wastes an investigation.
- Heavier to build and maintain than scoring claims independently, since it requires a linked entity graph, not just a claim-level feature table.
- A shared entity is frequently innocent, such as a large repair shop or a busy clinic that legitimately serves thousands of unrelated claimants, so raw connection count is a weak signal on its own.
Data needed
- Resolved identifiers linking claims to people, vehicles (VIN), addresses, phone numbers, bank accounts, repair shops, and medical providers.
- Entity resolution across inconsistent spellings, transposed digits, and shared households or business addresses.
- Claim-level detail needed to size a suspected ring's exposure: amounts paid, claim status, and dates.
How it is measured
- Confirmed ring size and total claim value once investigated.
- Precision of flagged clusters, meaning the share of a cluster's claims an investigator confirms as connected fraud rather than coincidental overlap.
- Entity resolution accuracy, measured against a manually confirmed sample.
Pitfalls
- Flagging every claim connected to a high-volume, legitimate repair shop or clinic as suspicious, which buries real rings in noise and damages the relationship with a provider the insurer actually needs.
- Acting on a cluster before entity resolution is validated, so a repair shop's misspelled name creates a phantom link between two unrelated claims.
- Treating cluster membership as a decision rather than a lead, which risks an investigator anchoring on the network instead of evaluating each claim in it on its own facts.
Human oversight
A specialist investigator reviews a flagged cluster, confirms the shared entities are genuinely connected, and only then opens or expands an investigation. No coordinated action, such as freezing a set of claims, happens without that confirmation.