How One Insurance Carrier Spotted a Fraud Attack in Progress and Stopped It Before It Scaled

A major U.S. insurer detected a subtle rise in suspicious online registrations involving stolen third-party identity details, suggesting fraudsters were attempting to establish accounts for later takeover. Rather than treating the activity as routine noise, the fraud team investigated quickly and determined that registration, traditionally subject to lighter controls than payments or claims, had become a key attack entry point. During the active incident, the team implemented a targeted rule within its existing decisioning system, using Socure’s RiskOS, Global Graph, and Local Graph identity signals to identify the pattern while maintaining step-up verification for uncertain cases. The approach avoided downtime and preserved approval rates for legitimate applicants, while flagged fraud reportedly increased by about 280% within a month and the attack was reduced to a manageable level. The case highlights the importance of treating registration as a fraud decision point, coordinating controls across systems, offering verification alternatives for borderline applicants, and responding rapidly across fraud, product, decisioning, and customer teams.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.