Auto Insurance Claims Fraud: Altered Estimates and Reports

A motor claim rarely arrives as one document. It arrives as a stack of PDFs: the body shop’s estimate, a supplement two weeks later, a crash report the claimant downloaded, a tow and storage invoice, sometimes a total-loss valuation and a counter-offer. Most of them passed through someone else’s inbox before they reached yours, and for many of them the file is the only evidence you hold.

This article covers one narrow layer of automobile insurance fraud detection: what the structure of each of those PDFs can tell a claims team, and what it can’t.

The short answer

Ask one question of every PDF in the claim file: was this file changed after it was issued?

HTPBE? answers that question by reading the file’s structure and history, not its content. The result is one of three verdicts – intact, modified or inconclusive – plus named markers for what was found. A marker might report, for example, that the file was saved again after it was created (HTPBE_MULTIPLE_REVISION_LAYERS) or that its modification date does not match its creation date (HTPBE_DATES_DISAGREE).

What it does not check:

• whether the figures on the document are correct;
• whether the police, the shop or the tow company actually issued it;
• whether the accident happened the way the claim says;
• photos of the damage.

Those are separate questions, and they need separate controls.

The motor-claim document set

Motor accounts for the majority of detected claims fraud by number, at least in the UK figures. The Association of British Insurers reported that UK insurers detected 51,700 fraudulent motor claims worth £576m in 2024 – 53% of all detected fraudulent general insurance claims by number. Across general insurance, detected fraud came to £1.16bn on 98,400 claims, and exaggerated loss was the most common type, at £466m. These are frauds insurers caught; the share they did not catch is unknown by definition.

Each document in a motor claim has a different author and a different route to the insurer. The route matters as much as the document type: a file that came straight from its issuer is a different object from one the claimant forwarded.

Every hand-off is a point where a PDF can be edited and saved again. Most of those edits are harmless; the job is to find the few that are not, without slowing down the rest.

Repair estimates and supplements: revisions are normal

Estimates change for legitimate reasons. A teardown finds hidden damage and the shop issues a supplement. A parts price changes and the estimate is re-issued. Three or four estimate documents on one claim is ordinary, and each one is normally its own file.

That is a different thing from one file being changed after it was produced, which is what a modified verdict reports – for example HTPBE_MULTIPLE_REVISION_LAYERS, meaning the file was saved again after it was created, or HTPBE_ONLINE_EDITOR_ORIGIN, meaning it carries the identity of an online editing or conversion service. A supplement does not explain a changed file, and a changed file is not proof of fraud either. The next step is to compare the whole document with the copy the shop sends you directly. If the two match, the edit did not change what the claim relies on. If they differ, the file goes to your special investigations unit (SIU).

The check matters most where the claimant, rather than the shop, is the courier. An estimate that arrives through your estimating platform or straight from the shop has fewer hands on it than one forwarded as an email attachment. The repair estimate tamper-detection page covers this document type in detail, and what adjusters miss in altered claim PDFs walks through how altered estimates, medical bills and receipts reach claims processing.

Police and crash reports: a copy, not the record

In some US states, people involved in a crash can buy and download the police report themselves. New York’s DMV, for example, lets you search, purchase and immediately download certified crash reports online. So the copy in your claim file has passed through the claimant’s hands.

File forensics can answer one question about that copy: did this PDF change after it was produced? It cannot tell you whether the content matches the agency’s record, whether an officer wrote it, or whether the narrative is accurate. If the report decides liability or the size of the payout, order the copy yourself from the same agency or portal, where you are entitled to request it, and compare.

Many crash reports also arrive as phone scans or photographed pages, and those often come back inconclusive: a scanned copy can never be confirmed intact, though some still show signs of editing and come back modified. An inconclusive result is not a sign of fraud or a reason to treat the claimant with suspicion; the answer has to come from the source.

The timeline across the claim file

Most PDFs carry their own creation and modification dates, and a motor claim has a fixed reference point: the date of loss. Lined up together, the dates of the estimate, the supplements, the tow invoice and the crash report should make sense against that date and against each other. A file last modified long after it should have been final is a question for the handler. Some dates move for ordinary reasons: a crash report bought from a portal may be generated at download time, so its creation date can fall well after the date of loss, and legitimate archiving and handling move dates too. Treat a timeline gap as a reason to look closer, not as a finding. For how a claims platform compares these dates automatically and routes each verdict to the right queue, see the claims-routing integration article.

What this does not catch

• Content that was false from the start. A document whose figures were wrong when it was first produced carries no evidence of a later edit, because nothing was changed afterwards. And a well-resourced, deliberate forger can sometimes produce a file that shows no structural sign of editing. It’s rare, but intact means no modification was detected, not that the document is genuine.
• Wrong figures in an issued document. HTPBE? does not read totals, labour rates, parts prices or line items. An estimate inflated inside the shop’s own system before the PDF was issued has no later edit to detect.
• Staged accidents and claim-level fraud. Staged collisions, phantom passengers and pre-existing damage are claim facts, not file facts. Claim scoring and investigation cover them.
• Photos and video. HTPBE? checks PDF files. It does not assess photographs of the vehicle or the scene.
• Issuer and police records. HTPBE? does not contact the shop, the tow company or the police, and it does not confirm that a document exists in their records.
• Intent. modified means the file was changed. It does not say who changed it or why. That is for the handler or SIU to establish.

Where it fits in motor claims intake

Run the check once per PDF, when the document is attached to the claim, before anyone relies on it. Then route by verdict:

• intact – normal handling. The file shows no evidence of a post-creation edit; everything else about the claim still gets its usual review.
• inconclusive – not a fraud signal and no reason to treat the claimant with suspicion. If the document affects liability or the payout, get it from its source before relying on it.
• modified – hold for review, with the markers attached. Compare the file with the issuer’s copy first; if they differ, send it to SIU. Declining the claim is not the next step.

A modified verdict is not a finding of fraud and should not on its own be the reason to decline or reduce a claim. Give the claimant or the issuer a chance to explain the change or supply the original.

Most documents go through untouched. For motor insurance fraud detection teams, the change is that the few edited files reach SIU with a reason attached, before payment rather than after. The insurance claims fraud detection overview covers the other claim document types, and how insurance fraud detection methods fit together explains where this layer sits next to claim scoring.

To try it on your own claim files, create an account: it comes with 5 welcome credits, and checks after that are pay-per-check (see pricing).

Frequently asked questions

Can HTPBE? tell whether a repair estimate is inflated?

No. HTPBE? does not read the figures, line items or labour rates on an estimate, so it cannot say whether a total is too high. It answers a different question – whether the PDF was changed after it was issued. If an estimate comes back modified, compare the whole document with the copy the body shop sends you directly. If the two match, the edit did not change what the claim relies on; if they differ, the file goes to review.

Does an inconclusive result on a police report mean the report is fake?

No. Scanned and photographed copies can never be confirmed intact, so unless they show signs of editing they come back inconclusive. That is a common result for this kind of file, not a sign of fraud and not grounds for denying a claim. If the report matters to liability, order the copy from the agency or state portal yourself, where you are entitled to request it.

Does an intact verdict mean the motor claim is genuine?

No. Intact means the file shows no evidence of being changed after it was created. A document whose content was false from the start, an estimate inflated inside the shop’s own system, or a staged accident can all sit behind an intact PDF. The verdict covers the file, not the claim, the figures or the events it describes.

For claims platforms

The HTPBE? API takes one POST to https://api.htpbe.tech/v1/analyze with a publicly accessible URL of the PDF and returns a check ID. A GET on https://api.htpbe.tech/v1/result/{id} returns the verdict and public marker IDs. Call it from the document-upload step of your claims system, store the check ID on the claim record, and route on the verdict. A test key returns synthetic scenarios for each verdict, so you can build and test the routing before any real claim document goes through it.