Workers' Compensation Fraud: A Full Investigation Guide

Workers' compensation is one of the largest single areas of insurance fraud investigation. Fraud here doesn't come from just one direction. It can originate with the claimant, the employer, or the provider. Each type requires a different investigation.

Claimant Fraud

Claimant fraud is what most people picture when they hear "workers' comp fraud." The most common patterns:

• Malingering: continuing to claim disability after medical recovery
• Exaggerated injury: a real injury inflated to produce higher indemnity
• Working while on indemnity (double dipping): holding a side job, running a business, or doing gig work while collecting benefits
• Faked injury: rare, but high-profile when it happens
• Post-termination or post-discipline claims: injury reported immediately after an adverse employment event

The primary investigative tools for claimant fraud are activity checks, sub rosa surveillance, social media investigation, and the claimant background investigation. All are covered in depth in our red flags post and our activity check vs. surveillance guide.

Employer Fraud

Employer-side fraud usually involves premium manipulation:

• Payroll misclassification: reporting employees in lower-rated classifications to reduce premium
• Ghost employees: fictitious payroll entries that move money off the books
• Premium fraud: outright understatement of payroll at audit
• Misclassification of employees as independent contractors: moving risk off the workers' comp book entirely

Employer-side investigation is financial. It runs on payroll records, tax filings, business ownership records, and premium audit support. It's a natural fit for a CFE-credentialed investigator. Our business ownership and shell company investigations post covers the structural side.

Provider Fraud

Medical provider fraud in workers' comp mirrors health-insurance provider fraud:

• Upcoding: billing for a higher-intensity service than was provided
• Unbundling: splitting a bundled procedure into separately billed components
• Phantom billing: bills submitted for services never rendered
• Kickbacks: referring claimants to providers in exchange for payment

Provider fraud investigations run on billing data, medical record review, and patient interviews. They often intersect with organized ring investigations. See also our medical fraud post for the broader scheme landscape.

Investigation Tools Specific to Workers' Comp

Beyond the standard fraud toolkit, workers' comp investigations make heavy use of:

• AOE/COE compensability investigation: confirming the injury arose out of and in the course of employment. Our AOE/COE explainer walks through this framework.
• Prior claims history: through ISO ClaimSearch and CLUE, plus independent court-record research. See prior claims and ISO ClaimSearch.
• Medical canvass: contacting prior providers to identify pre-existing conditions and apportionment opportunities.
• Side-job and gig-work investigation: surfacing undisclosed employment, 1099 income, and self-employment.

The 90-Day Window

California's 90-day good-faith investigation window, along with comparable rules across other western states, creates a specific operational pressure. Get the investigation done, cleanly, before the clock runs out. Our 90-day rule post goes into detail on what good faith actually looks like.

Putting It Together

A complete workers' comp fraud file typically ends up with some combination of:

1. Recorded statement from the claimant
2. Scene investigation
3. Prior claims and CLUE
4. Medical canvass
5. Sub rosa surveillance or activity checks
6. Social media investigation
7. Undisclosed employment / side-job investigation
8. Final SIU report and, where warranted, fraud referral to the state Department of Insurance

Our insurance fraud investigation services and AOE/COE services cover this full scope for carriers, TPAs, self-insured employers, and workers' comp defense counsel.