6 min read

Social Media Background Checks on Insurance Claimants

Ruby ParkPresident

April 6, 2026

Why Social Media Is a Standard Part of Claimant Background Platforms to Cover The Authentication Problem Verifying Account Ownership Privacy Limits Timing Cross-Platform Correlation Findings That Drive Outcomes Preservation Tools Reporting Format Integration with Other Investigations Permissible Purpose Building a Subject Identity File Before Searching Capture Workflow in Practice Coordinating Social Media With Field Surveillance Common Claimant Patterns and What They Indicate Working With Defense Counsel and Claims Staff

Platforms to Cover

Platform coverage should be comprehensive:

Facebook: largest platform for older age cohorts, still primary for many claimants
Instagram: lifestyle, physical activity, travel
TikTok: often the most revealing for younger claimants
LinkedIn: employment, current role, professional activity
X (formerly Twitter): public commentary and current activity
YouTube: long-form content, sometimes with substantial physical activity
Reddit: username-based, sometimes traceable
Snapchat: limited public content, but profile information sometimes surfaces
Dating apps (Tinder, Bumble, Hinge): occasionally reveal claimed activity, location, or occupation
Strava and fitness apps: physical activity tracking
Google Business, Yelp: self-employment and side business indicators
Pinterest: less common but sometimes surfaces travel or activity

The Authentication Problem

A screenshot is not evidence on its own. To be usable at deposition or trial, captured social media content needs:

Full-page capture with URL visible, not a cropped screenshot
Date and time of capture documented
Multiple-angle verification that the account belongs to the claimant (photo match, mutual connections, employment consistency, named family members)
Archive preservation via Archive.org and/or forensic capture tools
Investigator declaration authenticating the capture process

Verifying Account Ownership

Before you treat a profile as belonging to the subject:

Cross-reference the profile photograph with known subject photographs
Check identified family members and friends against known associates
Check listed employer against known employment
Check listed location against known address history
Look at post content for facts only the subject would know

False positives, mistaking one person for another, are a real risk in common-name cases. Verification is mandatory before the profile goes into a report.

Privacy Limits

Investigators cannot:

Create fake profiles to friend-request the subject (pretexting)
Use another person's credentials
Access accounts through compromised passwords
Use tools that bypass platform authentication

These are Terms-of-Service violations and potentially violations of state and federal computer-crime statutes. Our surveillance privacy laws post touches on related considerations.

What investigators can do:

Review and preserve publicly visible content
Review profiles of friends or family who have publicly posted content mentioning the subject
Use legitimate investigative databases to tie usernames, email addresses, and phone numbers to the subject
Capture publicly available platforms for archiving

Timing

Subjects often begin deleting or restricting social media when:

They are told the carrier is investigating
Their attorney advises them of surveillance possibilities
Litigation becomes clear

Early capture, in the first days of a claim referral, preserves content that might be gone a week later.

Cross-Platform Correlation

A high-value OSINT pattern is cross-platform correlation:

LinkedIn confirms employment; Facebook shows daily activity
Strava shows athletic activity; Instagram shows the subject at a race
Yelp reviews for a self-employed service business; Facebook shows the subject performing that service
Multiple platforms showing travel during claimed disability

Findings That Drive Outcomes

Recurring high-value findings:

Physical activity inconsistent with claimed restrictions (running, skiing, heavy lifting, dancing)
Employment or self-employment during indemnity benefit period
Travel inconsistent with residency or disability claim
Timeline contradictions between claim representations and public posts
Prior injury and litigation indicators in historical posts

Preservation Tools

Standard tools include:

Browser full-page screenshot (single-page capture with URL)
Archive.org Wayback Machine for historical snapshots
SingleFile or comparable full-page archiving tools
Hash-value preservation for digital evidence
Forensic capture tools for high-value cases

Reporting Format

A social media section of a claimant background report includes:

Platforms reviewed (with dates)
Confirmed account for each platform (with verification basis)
Key findings organized by relevance to the claim
Exhibit index of captured content with URL and timestamp
Timeline of key posts relative to claim dates
Investigator declaration

Integration with Other Investigations

Social media findings feed into:

Permissible Purpose

For insurance claims, social media investigation typically operates under the carrier's claim-investigation permissible purpose. For pre-employment or underwriting use, FCRA compliance may apply. See our FCRA and GLBA compliance post.

Building a Subject Identity File Before Searching

Before a single platform is queried, the investigator should assemble an identity file on the claimant. Searching by name alone produces noise. Searching with structured identifiers produces leads. A workable identity file includes:

Full legal name with common variants and nicknames
Date of birth
Current and prior addresses
Known email addresses
Phone numbers
Employer history
Spouse and immediate family names
Any publicly known usernames or handles

Each of these becomes a pivot point.

Email addresses are often the most productive pivot. A claimant's personal email address, when run through reverse-lookup tooling, frequently surfaces registered accounts on platforms the claimant has forgotten about: old fitness apps, forum memberships, recreational league rosters, and review sites. Phone numbers pivot similarly, and sometimes reveal business listings tied to undisclosed self-employment. This groundwork is the same discipline we apply to any structured background investigation, and it meaningfully reduces the false-positive rate on common-name subjects.

A thorough identity file also prevents the most embarrassing failure mode in social media work: reporting on the wrong person. In workers' compensation and liability cases, confusing two people with similar names can derail an otherwise strong defense. It also exposes the carrier and defense counsel to legitimate criticism. The time spent building the identity file up front is the cheapest insurance against that failure.

Capture Workflow in Practice

The actual capture sequence matters as much as the tooling. A workflow that holds up under cross-examination typically looks like this. The investigator first documents the date, time, time zone, IP context, and investigator identity in a contemporaneous log. Each profile URL is then visited directly, not through a cached result or a third-party aggregator. The full page is captured using a tool that renders the complete post, comments, and metadata. A parallel capture is pushed to Archive.org where platform terms permit, creating a third-party timestamp that cannot be altered by the investigator.

For video content, the workflow includes downloading the file where lawful, generating a cryptographic hash, and logging that hash in the exhibit index. If a post has multiple images in a carousel, each image is captured individually with its position noted. Comments, reactions, and timestamps are captured in the same pass. A claimant's acknowledgment of a friend's comment about a ski trip is often more probative than the photograph itself.

When cases warrant deeper analysis of devices, location metadata, or recovered content, social media findings regularly hand off to our digital forensics team for extraction, authentication, and expert testimony support.

Social media is most powerful when it informs, rather than replaces, field work. A claimant's Instagram story showing a Saturday morning pickup basketball game at a specific park is a surveillance tasking, not a conclusion. Deploying a field investigator the following Saturday, consistent with the patterns our surveillance and activity checks program runs every week, converts a social media lead into filmed, dated, geolocated video evidence that is far harder to contest than a screenshot alone.

The coordination runs both directions. Field surveillance that captures a claimant entering a gym, loading construction materials, or attending a child's sports event gives the social media analyst new search terms, locations, and associate names to pursue. Claimants frequently post about the same activities the field team just filmed. Those posts, captured the same day, create a devastating timeline when paired with the footage. This is standard practice on our insurance fraud investigations, and it is the most effective pattern for moving a case from suspicion to documented fraud.

Common Claimant Patterns and What They Indicate

Experienced investigators learn to read patterns rather than individual posts. A claimant who abruptly locks all accounts within days of filing is signaling awareness of exposure. The prior public content, if preserved early, often tells the real story. A claimant whose Facebook goes quiet while a newly created Instagram account under a slight name variant becomes active is executing a common evasion pattern. The new account is often tied back through mutual friends, profile photos, or tagged locations.

Self-employment indicators are another recurring pattern. A claimant on total temporary disability who is quietly running a detailing business, a handyman operation, or a side catering service will almost always leave traces:

A business page with customer reviews
Tagged photos from satisfied clients
A Venmo or Cash App handle referenced in comments
A Google Business listing with posted hours

In workers' compensation matters, these findings sit at the core of the AOE/COE workers' compensation analysis and often drive the direction of the compensability decision.

Travel patterns deserve particular attention. A claimant who reports being housebound but tags beach resorts, ski lodges, or international airports is producing self-authenticating impeachment material. The timestamps and geolocation data embedded in many posts give defense counsel a foundation to walk the claimant through at deposition, one post at a time.

Working With Defense Counsel and Claims Staff

Social media findings are only as useful as the downstream professionals can make them. Reports should be structured so a claims examiner can read the executive summary and understand the exposure picture in five minutes. Defense counsel should be able to turn to the exhibit index and pull deposition-ready materials without reformatting. Investigators should be available to authenticate the capture process at deposition, provide declarations for motion practice, and supplement the report when new content appears.

We routinely coordinate with defense counsel before a claimant's deposition to sequence exhibits, identify the strong