The afternoon a real photo beat my detector
I remember the exact test that changed the product. I had been treating this like a detection problem: feed a claim image to a good authenticity model, get a fraud score, done. Then I dropped a genuine camera photograph into my own test set, one lifted from an older settled claim, and my detector waved it straight through. It was right to. The photo was real. Every pixel of it came off a real phone, so every authenticity test it could ever face came back clean. I sat there realizing the fraud I most wanted to stop was the one my whole approach was structurally blind to.
That is the uncomfortable part of insurance-claim fraud in 2026. A deepfake detector can get better every quarter and still never see a recycled real photo, because being real is the entire trick. Verisk's 2026 State of Insurance Fraud found that 65% of insurers now run a third-party AI detector and 36% of consumers say they would alter a claim image. The detectors are spreading. The oldest fraud in the book walks around all of them.
Why I stopped building a better classifier
I quit the classifier arms race that same week. A better model was never going to close the gap, so I built a forensic gate instead: a queue that opens a full claim packet (the photo, the first-notice-of-loss narrative, the metadata, and the carrier's existing severity score) and runs several independent evidence checks against each other before the claim is ever assessed for damage.
The case I built the whole thing around is a synthetic claim in the demo, CLM-C-1044, a rear-end collision filed under Maple Mutual. Its photo is a real capture. Provenance passes: the GPS sits within 1.1 km of the reported loss location and the capture date lines up. The simulated pixel-forensics signal passes too. On authenticity alone, this claim clears and gets paid. But the reuse check matches its perceptual hash to a settled prior claim, HIST-4019, at a hamming distance of zero, an identical image, and the narrative check notices the account describes side damage while the photo shows the rear. Two independent signals disagree with the story. The gate refers it to Special Investigations at 0.96 confidence.
None of that is a smarter detector. It is corroboration. When I ran the gate across a fixed, labeled set of 120 synthetic claims, the result that mattered to me was not an accuracy score, it was a coverage gap: of the 35 frauds that carry no authenticity artifact at all (20 recycled real photos plus 15 metadata-spoofed reals), a single-signal authenticity baseline catches 0. The gate catches all 35, and it routes 0 of 47 clean claims to SIU. I want to be exact about the scope, because that honesty is half the point: these are figures on a constructed synthetic set whose fraud classes carry detectable signatures by design, not an open-world guarantee. The number I actually trust is the 0-to-35 gap against the incumbent a lone detector represents, not a headline percentage.
The signal I deliberately refused to trust
I made one call on this build I am still glad about: I refused to let the impressive signal carry the catch. One of the four analysts is a pixel-forensics model that reasons over sensor noise and frequency artifacts, exactly the kind of thing a demo wants to show off. It is also the piece I have not actually built yet. So I labeled it SIMULATED everywhere it appears on screen, a stand-in for a future learned model, and I made sure no routing decision leans on it.
That constraint is visible right in the CLM-C verdict panel. The pixel-forensics analyst returns "consistent" with an artifact score of 0.06. If the catch depended on that signal, it would have failed. The two flags that actually survive are the reuse match and the narrative contradiction, both deterministic checks over real bytes and real text. The adversarial challenger, a skeptic I prompt specifically to try to clear the claimant so a legitimate policyholder does not get falsely accused, tested both flags, and both survived.
I have watched too many AI demos win on the one component that would not survive contact with production. Deferring the real pixel-forensics model, the Guidewire and Duck Creek connectors, the mobile capture SDK, and a real camera-fingerprint database was not me hiding weakness. It was me making sure the thing that works works for reasons I can defend.
The part I actually lose sleep over: proving it
What kept me up was not detection, it was proof. Catching the fraud is the part everyone films. Being able to prove, months later in front of a regulator or a court, that you caught it and never touched the original evidence is the part that decides whether an automated claims decision survives. So every verdict the gate makes gets sealed into an append-only, hash-chained ledger: the original's SHA-256 at intake, each analyst's finding, the rule that fired, and a NAIC and EU AI Act compliance mapping.
The test I am proudest of is the one that fails on purpose. I select a cleared original, click tamper (simulating a GenAI "enhancement" overwriting the source), and re-verify the chain. The row turns red: ALTERED, spoliation detected. The whole chain breaks. That is not a classifier output, it is a property of the ledger, and it holds no matter how good or bad any model happens to be.
This is also why I keep the routing decision out of the language models entirely. The analysts advise; a deterministic policy gate written in plain code makes the call, so the same claim always routes the same way and I can hand a regulator the exact rule that fired. That matters more every month. The NAIC Model Bulletin has been adopted by 24 states, the Colorado AI Act takes effect on June 30, 2026, and the EU AI Act's high-risk deadline lands in August 2026 with penalties up to €35M or 7% of global turnover. Outsourcing the AI does not outsource the liability.
What I keep asking myself now
I built this to sit in front of damage assessment, not to replace it. It authenticates the evidence that tools like Tractable and CCC then score, and it abstains to a human when the evidence is genuinely thin rather than bluffing a pass. You can trace a claim through the whole gate yourself at veriprajna.com/demos/insurance-claims-ai.
The question I cannot put down is the one that started all of it: if the most dangerous piece of evidence in your pipeline is a photo that is completely real, what in your current stack would ever flag it? I did not have an answer I liked. That is why there is a demo.