Investigators trawl social media to catch fraud

It starts like any love story: twenty-something girl meets car. Girl and car get into a crash. Girl files a catastrophic injury claim with her insurance company. Then girl goes off the grid.

“…All our surveillance attempts were negative with respect to locating her,” says Keith Elliott, vice-president of operations and business development at Reed Research, an investigative firm in Toronto. So the team checked if Facebook posts or tweets could reveal the girl’s location. They ended up finding her Instagram account, and because the photo-sharing site automatically geo-tags uploaded images, Elliott could “map her out and ultimately figure out where she was posting from on a regular basis.”

Satellite images revealed a trampoline in the backyard of where the girl was staying. “…I’ll leave your imagination to [do] the rest with respect to what was observed or documented,” says Elliott.

People in Trampoline Girl’s age bracket are, of course, more likely to tweet about their breakfasts or post vacay selfies than their grandparents. But that doesn’t mean one demographic attempts insurance fraud more than others. “You have young people, you have old people,” says Kadey Schultz, a partner at law firm Hughes Amys who often works with Elliott when researching cases. “You have people who have been in Canada for five generations, you have people who have been in Canada for 14 seconds… There is not a profile I could give you because it’s an abundant system.”

And those who get caught online aren’t career criminals. Most often, they’re everyday policyholders who file an exaggerated or outright fake personal injury claim to make the most of a broken ankle. “Professionals typically don’t advertise their activities on social media,” says Chris Mathers, president of his own investigative firm, Chris Mathers Inc. “I think the highest chance of trapping fraudsters in the insurance domain would be the individual consumer who maybe brags about something they’ve done on social media.”

“I call that self-surveillance,” says Jason Frost, an associate at Hughes Amys and one of Schultz’s colleagues. “How people will not think about it and go about their ordinary, day-to-day routine [and] broadcast it to the world… without thinking about ‘Oh, how will this conflict with the claim that I’m advancing or is being advanced on my behalf?’”

A country full of self-surveyors can only help fraud investigations, but as Elliott points out, investigators don’t start searching for damning evidence. “Our job is not to go out and fry them or cook them,” he says. “Our job is to get a real evaluation of their current abilities and ultimately provide that evidence to the insurance company…” But since he only sees cases after insurers have flagged them as suspicious, he usually finds a disconnect between the claim and reality.

First, you have to be sure you’re tracking the right person, both on and offline— there are, after all, more than 7,000 Joneses listed in Ontario and another 3,000 in British Columbia. “It’s degrees of separation” that are useful, says Elliott. “If I know who the kids are, who the wife is, who everyone else is, and they have that individual in common, then I’m going to ultimately find that that individual is there… We can create [timelines] with respect to that.”

Once an investigator determines a claimant’s appearance, family members, hobbies and haunts through social media, it’s easier to take surveillance off the computer and onto the road. Elliott brings up the case of a man who took several short-term disability leaves from his physical labour job because of a back injury. He had a social media account set up under a pseudonym, but it was connected to the claimant’s family, and investigators discovered the man was an amateur boxer. They followed his posts to “the actual boxing event, where ‘J.P.’ went four rounds in a boxing fight when he’s supposed to have a bad back and be off work,” says Elliott.

Eight, nine, ten… and J.P.’s claim was knocked out. And he ended up losing his job as well.

Creeping, not poking

But suppose your claimant’s more careful. They’ve got excellent security settings. Their Facebook profile only shows a list of friends. Hmmm…

Well, investigators can still gather a lot of information. “I would start by looking for people who have the same name,” says Kadey Schultz. “It’s family members who tend to post the most about their family.” And because individuals not currently under investigation tend to keep tweeting and posting as usual, it’s possible to find pictures of an allegedly bedridden claimant running the Boston marathon in their mother’s photo album on Facebook.

Even if they unearth rock-climbing pictures posted after a car crash, investigators also need to prove the photos were taken after the accident. Some social media sites like Instagram upload metadata revealing when, where and how the photo was taken, but others, like YouTube, don’t provide anything. So all evidence gathered from social media must be accompanied by physical surveillance.

“No insurance company is going to rest their case on that individual piece of evidence,” says Elliott. Dates can be disputed and imageless posts can be written off as a joke, “so the post is good, but it’s even better if it’s done in conjunction with some surveillance that ultimately shows that what they post is what they do.”

When looking for information online, investigators can’t make direct contact with the claimant. “You’re allowed to creep, you’re not allowed to poke,” says Schultz. This means only accessing information that’s publicly available—so no “friending” the claimant on Facebook. If an investigator or a lawyer were to do so, the information might not be admissible in court because it violates their code of conduct. “…If a person is represented, you’re not allowed to approach them. You have to communicate through counsel.” This isn’t new; even before the Internet, lawyers and investigators couldn’t show up at a plaintiff’s workplace and try to speak with them.

But creeping can take you far. If a person comments on a public forum through their Facebook account, that comment is fair game. And if their profile is open to all University of Manitoba alumni, for example, investigators can set up an account that would give them access. “I’m not, per se, friending that individual,” says Elliott. “I am simply mirroring a profile that other people already have in place… that allows them to view certain things, right?”

Creeping can also lead you to potential witnesses. “The bad guys are not going to come and turn themselves in,” says Mathers. “You have to get out there and do the legwork. The way to do that is by talking to people. So any technique you employ that will identify more potential interviewees is going to make your job a little bit easier.”

Offline judgement

The good news from the gavel is that courts have recognized the validity of evidence gathered through social media, both through creeping and through official channels. In 2009, an Ontario Superior Court judge ruled that social media posts count as documents under the Rules of Civil Procedure, meaning lawyers can both request access to the posts and question the claimant about what’s posted. So when representing insurers who are challenging personal injury claimants, Kadey Schultz can immediately ask for “the preservation and production of all social media information that is relevant to the claim.”

Insurers shouldn’t worry that claimants will delete their Facebook accounts as soon as lawyers demand access; their lawyer must tell them about their obligation to preserve and produce all relevant documents that are in their care or control. And if a claimant has deleted their profile already, insurers could still find the information, since supposedly nothing online is ever truly deleted. Although it would be expensive, “you could apply for an order to—at the defendant’s cost—recover the data from Facebook or from another social media site,” says Schultz.

One way to access social media data without asking for Facebook’s permission is to use the Internet Evidence Finder, software developed by Magnet Forensics in Waterloo, Ont. The IEF allows investigators to access social media profiles and other data stored on, or even deleted from, a computer or smartphone without requiring the password.

“A lot of this data will sit in… unstructured fashions on the computer,” says a Magnet Forensics spokesperson. “So if you were to actually see what the file was, if you were to just go in, in the nontechnical sense, even if you knew exactly where it was, the file would be a bunch of ones, zeros and jargon.” But with IEF software, “you could basically see a thread of messages.” He says as long as the computer or phone is obtained legally, all evidence found using the IEF is admissible in court.

Schultz and her team usually aren’t given the claimant’s computer or password but instead meet at the defense lawyer’s office where the claimant would grant them access to their accounts. “Counsel or someone from their office would sit with us while we go through the information. … And we would print everything.”

Investigators always keep a record of information they find online, whether that’s through screenshots, printouts or more advanced techniques. Elliott actually uses an application that documents all aspects of a social media profile in real time. The program creates an interactive facsimile of the claimant’s profile. “…It’s isolated so that if it were ever taken down, destroyed or otherwise by the party, our portion stays exactly as it was.”

However you find them, most insurance fraudsters caught on social media don’t seem to be trying to scam millions. “It’s not out-and-out fraud,” says Frost. “Typically, someone is relying upon their legal representative who continues to send forms in to try to seek the maximum benefits possible” after a legitimate insured accident.

Jason Frost brings up the case of a twentysomething college student who fractured his wrist in an accident and kept claiming non-earner benefits, housekeeping benefits and attendant care, even after his cast came off. During an examination under oath, Frost learned the student had a YouTube channel, and right there in the court reporter’s office, he went to find it.

“We pulled up the YouTube channel, and sure enough he had a cooking show!” says Frost. “Including several episodes immediately after the accident. He’s in his kitchen, cooking with the cast on!”

Video stills were enough to convince the student’s lawyer that the claim wasn’t worth pursuing, and it was settled out of court. Frost doesn’t think badly of the kid. “He was a nice guy. He wasn’t trying to deceive the insurer… There’s a gap between a person’s day-to-day level of function, and the claims forms that continue to be submitted on their behalf.”

__________________________________________________________________________
Copyright 2015 Rogers Publishing Ltd. This article first appeared in the April 2015 edition of Canadian Insurance Top Broker magazine

This story was originally published by Canadian Insurance Top Broker.