Encyphir Risk Management
2 min read

Social Media Investigations for Insurance Claims

Ruby Park
Ruby ParkPresident
April 5, 2026
Social Media Investigations for Insurance Claims

Table of contents

What Social Media Investigations Look ForPlatforms That MatterThe Authentication ProblemPrivacy and Access LimitsTimingSocial Media as a Surveillance Scoping ToolSocial Media in Surveillance ReportsThe Overlap with Background Investigations

Categories

SurveillanceOSINTInsurance

Social media is the cheapest, fastest, and most underutilized surveillance tool in insurance claims investigation. Almost every claimant leaves a public footprint somewhere: Facebook, Instagram, TikTok, LinkedIn, X, YouTube, Reddit, or dating apps. That footprint regularly contradicts claim representations. But to be useful at deposition or trial, the investigation has to be done right.

What Social Media Investigations Look For

Depending on the claim, investigators look for:

  • Activity inconsistent with claimed physical restrictions (running, hiking, dancing, heavy lifting)
  • Evidence of undisclosed employment or self-employment, see undisclosed employment investigations
  • Travel inconsistent with claimed disability or residency
  • Contradictions between claimed loss and posted reality (a "stolen" item appearing in a later post, a "destroyed" home shown intact)
  • Prior history: prior injuries, prior accidents, prior litigation hints
  • Relationships: associates, co-workers, spouses, business partners

Platforms That Matter

  • Facebook: still the largest source of personal posting for many age cohorts
  • Instagram: lifestyle, travel, fitness, family
  • TikTok: often surprisingly revealing about daily activity
  • LinkedIn: employment, professional roles, self-employment indicators
  • X (formerly Twitter): professional commentary, occasional personal posts
  • YouTube: hobby content, sometimes with long-form physical activity documented
  • Reddit: under usernames often traceable back to the claimant
  • Dating apps: sometimes surface claimed availability, occupation, and location
  • Google Business listings / Yelp: side-business indicators
  • Strava / fitness apps: high-value for physical activity claims

The Authentication Problem

A screenshot on its own is nearly worthless at deposition. The defense will ask several questions:

  • Was this really the claimant's account?
  • Was this really posted on this date?
  • Was this really posted by this user?
  • Could it be fabricated?

Proper social media investigation produces:

  • Authenticated account identification (cross-referenced to known claimant facts: photo, employment, mutual connections)
  • Full-page, URL-visible captures, not just screenshots
  • Web archive preservation (Archive.org, SingleFile captures)
  • Hash-value preservation where applicable
  • A timeline linking posts to known claim dates
  • An investigator declaration authenticating the capture process

Privacy and Access Limits

Public posts are fair game. Private posts, meaning content only visible to accepted friends, are not. An investigator cannot:

  • Create a fake profile to friend the claimant (pretexting)
  • Use another person's credentials to access private content
  • Access accounts via compromised passwords

These rules come from both platform Terms of Service and state/federal anti-hacking law. Our surveillance privacy laws post touches on this.

What investigators can do:

  • Capture public posts, profiles, and metadata
  • Review content made available to the public
  • Preserve content before it gets deleted
  • Use legitimate investigative databases to tie usernames and email addresses to the claimant

Timing

Claimants often begin deleting social media content once they realize they're being watched or once litigation begins. Early capture is critical. On any serious claim, social media preservation should happen in the first days of the file, before the cleanup starts.

Social Media as a Surveillance Scoping Tool

Beyond its own evidentiary value, social media is one of the best inputs to a sub rosa surveillance plan. Posts often reveal:

  • Daily schedule
  • Recurring locations (gym, work, school, hobby)
  • Events the claimant will attend
  • Activity the claimant is proud of and likely to repeat

Social Media in Surveillance Reports

A strong surveillance file often combines sub rosa video with preserved social media evidence. The two together create a compelling timeline: "here is what the claimant told us, here is what they posted publicly, here is what they actually did."

The Overlap with Background Investigations

Social media investigation overlaps significantly with claimant background investigations. The background team and the surveillance team often share findings. Our insurance background services and surveillance services are staffed to run these in parallel.