Beating Fraudsters at Their Own Game: A New Approach for UK Insurers

This piece is by Chad Reimers, Vice President (International) – Global Fraud Solutions

Insurance fraud is evolving quickly, and – while UK insurers are facing increasing pressure from several threat vectors – two fraud typologies represent particular hot-spots: the misuse of synthetic and stolen data, and fraudulent documents and manipulated images being submitted, particularly during the claims stage.

Both threats are real and growing, with 91% of insurance professionals concerned about synthetic identities affecting their books according to the 2025 TransUnion Business Survey, and 73% of respondents to the TransUnion UK TruValidate and Identity Fraud Survey citing AI fraud as a top concern. Furthermore, the broader environment is making the industry more vulnerable to fraud, with consumers under pressure in a high inflation soft labour market.

Stolen and synthetic data (fraudulently created data that mimics real information) rank among the easiest commodities for fraudsters to acquire. Dark web marketplaces sell lists of names, account numbers and email addresses cheaply, ready to deploy against any target. Meanwhile, stolen and synthetic documentation is increasingly available, including identity documents, claims paperwork, repair invoices and images of supposed damage. These each require nuanced detection methods, and many insurers fall victim to fraudsters by applying a one-size-fits-all approach.

Why Insurance Is Particularly Vulnerable

Insurance carries a specific risk profile for a number of reasons. Firstly, the volume of prospective customers that arrive through aggregators and quote journeys means insurers need to adopt automated, data-led onboarding approaches. While these approaches are fundamental to how insurers enable growth, they present an opportunity for fraudsters to leverage compromised or synthetic identities to bypass low-friction know your customer (KYC) checks.

From here, they can get access to policies that allow them to insure vehicles, which can then be used to perform illegal activities such as transporting illicit items across the country, filing false claims, or obtaining life insurance policies which are later claimed on. For synthetic identities specifically, fraudsters may use insurers as an initial entry point for them to be able to incubate and build up their reputation in order to access credit facilities elsewhere.

Adding biometrics at relevant stages of the customer journey addresses many of these challenges. Policyholders can’t forget their faces – and fraudsters can’t copy them either! Advanced software ensures that access is only given to someone with the biometric data such as facial features that’s on record, and that extra layer materially strengthens identity verification for fraudulent applications.

AI and Fake Documents: Less Accessible Than Feared?

AI is a buzzword that’s appearing everywhere and being colloquially blamed for many incidents of fraud and impersonation, but the reality is more measured. Public tools like ChatGPT, Sora, Midjourney and Nano Banana produce fun and frivolous images and posters, but thanks to guardrails put in place by their creators, they won’t generate ID documents or anything that could be used to commit fraud.

To create convincing fake documents, a fraudster must take the work offline and run their own AI models. That’s ‘work’ that demands serious hardware, significant server space and genuine technical skill. AI may have made document fraud easier for those determined to commit the crime, but it broadly remains the preserve of dedicated, skilled operators. It’s a deliberate plan, intentionally executed, and not an ad-hoc event.

Manipulated Documents – Defence 1: Live Document Capture

Here’s the encouraging part: Even though AI-generated documents are becoming more sophisticated, they can still often be identified when they are ingested into a trusted environment designed to detect the signals that separate authentic content from manipulation. The single most important step is to capture a live picture of the documents rather than accept an upload, which strips away most of the signals that fraud detection solutions rely on.

A live capture with a camera opens up rich detection options that reflect light in a particular way, for example. Some documents use slightly raised lettering and this font depth is a useful measure. The guilloche (metal inlay) in a passport reflects light at varying angles, and background watermarks are visible only when held at certain angles.

If a fraud detection system is set up to capture a flat, two-dimensional upload, all of this valuable information is lost. The basic test still applies too: confirm the document isn’t on a screen or a screenshot. Unless a fraudster owns a printer that prints onto polycarbonate plastic, a fake will look like it’s on a screen, paper or card.

Manipulated Documents – Defence 2: Leveraging Metadata

Identity documents are one thing, but claims paperwork is another realm entirely. Invoices and repair estimates need no skill to fabricate, templates are freely available, and online AI can generate one in moments.

With identity documents, known templates provide a starting point because a central authority issues each passport or driving licence and changes the design only every few years. A repair invoice has no such standard – for example, every repair garage produces its own documentation so there could be tens of thousands of legitimate formats.

The answer is to understand the document’s metadata, which reveals an audit trail of how a document came to be. Major providers – such as banks, utilities and telcos – use central document-creation software that produces files consistently and sends them unchanged; encountering an edited version of one these is a marker for suspicious activity. Metadata reveals when a change occurred, what changed and which software made it. An issuing authority is also unlikely to use free or mass-market solutions to produce their uneditable documents.

Font analysis adds another layer. Many large providers use a proprietary font, and leading solutions in market can identify when a font has been swapped, even for a close match. The same logic catches edited invoices from smaller, independent businesses too, since editing software rarely matches the original creation software.

Manipulated Documents – Defence 3: Detecting Fraudulent Images

Manipulated images of staged accidents or flood damage can be identified with similar methods. Think of an edited image as a painting more than a wall: the original layer sits beneath the new one, and layer by layer analysis exposes changes.

Furthermore, some image generators supply metadata showing whether a file was created or edited. Many AI images, particularly those made through online services, also carry a visible or invisible watermark, and that’s exactly where most fraudulent images originate.

Synthetic Identities Move Mainstream

Synthetic identity fraud is no longer a niche threat discussed in theory and deprioritized in practice. It has become a mainstream, industrialized form of fraud – one that, in many respects, is more complex than traditional identity theft because it is based not on impersonating a real consumer, but on fabricating an entirely new one.

At its core, synthetic identity fraud combines fragments of legitimate information with fabricated details to create identities that can appear credible enough to pass onboarding and verification checks. As AI accelerates the creation of supporting documents, facial imagery and other fraudulent artifacts, this threat is becoming more scalable, more repeatable and more difficult to detect.

For insurers, the challenge is particularly acute because synthetic identities are often designed to mature over time. Rather than acting immediately, these fabricated identities may establish a record of apparently legitimate behaviour — maintaining policies, paying premiums and avoiding early scrutiny — before being potentially used to support a claim that appears valid on the surface. This is not opportunistic fraud; it is a patient, deliberate strategy designed to exploit weaknesses in identity and claims workflows.

Traditional checks focused only on whether an identity appears valid at a single point in time are often insufficient to identify this type of fraud. It’s more important to see whether that identity behaves like a real person over time, across products (and even sectors) and in context. Answering that question requires a broader view – one grounded in cross-industry intelligence, behavioural signals and the ability to assess whether an identity is coherent across the full consumer lifecycle. Understanding, for example, a longitudinal view of relationships between personal identity information and associated emails and phone numbers is a unique way to identify suspect networks. Layering in device intelligence to understand the device – not just the presented identity – is another option to (with limited friction) build a more holistic view of customer interactions.

The Way Forward: A Friction-Right Approach

While there appear to be ever-increasing ways for fraudsters to deceive the system, the lesson across all of this is to look beyond face value. Modern fraud technology can examine the audit trail, the layering of images and how a file was created or edited rather than relying on a human eyeball check. These technologies should be combined with leveraging powerful data insights.

That doesn’t mean switching every control on at once – implementing too many barriers and introducing too much friction will impact legitimate customers signing up for services. The smarter model is a friction-right approach: layering the appropriate solutions proportionately in line with identified threats and, importantly, strategic business objectives. Some customers need only a data check. Others warrant a more robust ID, document or biometric check. The skill lies in turning controls on and off as risk demands, keeping the balance right for genuine users while testing your defences regularly.

The fraud landscape will keep shifting, but insurers are far from powerless. The technology and signals to detect synthetic data, fabricated documents and manipulated images is mature and proven. What matters now is adopting it intelligently: multilayered, adaptive and applied with proportion. Insurers ready to move beyond manual review and legacy processes will be more likely to protect their books, their customers and their reputations – and enable safe, profitable, and sustained growth. The question isn’t whether the tools are available; it’s how quickly and effectively they’re put to work.

About TransUnion

TransUnion is a global information and insights company with over 13,000 associates operating in more than 30 countries and territories, including the United Kingdom. We make trust possible by ensuring each person is reliably represented in the marketplace. We do this by providing an actionable view of consumers, stewarded with care.

Through our acquisitions and technology investments we have developed innovative solutions that extend beyond our strong foundation in core credit into areas such as marketing, fraud, risk and advanced analytics. As a result, consumers and businesses can transact with confidence and achieve great things. We call this Information for Good® — and it leads to economic opportunity, great experiences and personal empowerment for millions of people around the world. For more information, visit www.transunion.co.uk