Blog
Mandatory fraud reporting and immunity laws for insurers
Why most states make insurers report suspected fraud and shield them from defamation suits when they do, and what that means if you are the one reported.
Many states require an insurer that suspects fraud to report it to a government fraud unit, and nearly all of them protect the insurer from defamation and similar lawsuits over that report as long as it acted without malice. The trade is deliberate: lawmakers want insurers to pass suspicions along without fear of being sued by the person named, and they accept that some honest people will be reported by mistake. For a policyholder, the practical result is that you can be reported without being told, and you usually cannot sue over a report that was made in good faith.
The details sit in state law, not in a single national rule, so the deadlines, the recipient agencies and the immunity wording differ. This article walks through the NAIC model that many states borrowed from, three state examples read in full in November 2026, and what to do if you think a report about you was wrong.
Why states require insurers to report
A fraud bureau cannot investigate what it never hears about, and the people best placed to spot a false claim are the adjusters and investigators who handle thousands of them. Without a reporting law, an insurer that suspected a ring could quietly deny the claim, which let the scheme move to the next company, or tell police and other insurers and risk a libel or slander suit from the person it named.
Mandatory reporting fixes the first problem and immunity fixes the second. The NAIC's Insurance Fraud Prevention Model Act, in the July 2003 version of the NAIC model-law compilation, states its purpose as letting the insurance commissioner use expertise to investigate and discover fraudulent acts more effectively, halt them, and work with state, local and federal law enforcement. The NAIC is the association of state insurance regulators, and its models are templates that each legislature may adopt, change or ignore; Why insurance is regulated by states, not Washington explains why.
What the NAIC model says
The model act is short enough to describe section by section. These are the parts that matter to consumers.
- Reporting (Section 6). A person engaged in the business of insurance who has knowledge or a reasonable belief that a fraudulent insurance act is being, will be or has been committed must give the commissioner the information in the form the commissioner prescribes. Anyone else "may" report.
- Immunity (Section 7). No civil liability and no cause of action arises from furnishing information about suspected, anticipated or completed fraud to the commissioner, to law enforcement or regulators, to people involved in preventing and detecting fraud, or to the NAIC. The protection does not apply to statements made with actual malice, and a plaintiff who claims actual malice must plead it specifically.
- Confidentiality (Section 8). Reports and investigative material in the department's hands are confidential and privileged, not open to public-records requests, not subject to subpoena, and not discoverable or admissible in private civil actions, though the commissioner may use them in official actions.
- Insurer anti-fraud initiatives (Section 11). Insurers must have initiatives reasonably calculated to detect, prosecute and prevent fraud. The model suggests investigators (employees or contractors) or an anti-fraud plan filed with the commissioner, and makes any filed plan confidential.
- Penalties (Section 13). License suspension or revocation, civil penalties, or criminal penalties, with mandatory restitution on conviction and disqualification from insurance for a felony conviction.
Notice what the model leaves out: it does not set a number of days for the report. Deadlines come from the states.
Three states, three versions
| California | Texas | Florida | |
|---|---|---|---|
| Who must report | Licensed insurers, after the SIU investigation | The person who determines or reasonably suspects fraud | Insurers, agents and other persons licensed under the code, and some professionals |
| Deadline | Within 60 days after the insurer's determination | Not later than the 30th day after the determination or reasonable suspicion | Not stated in the statute text read |
| Recipient | Department of Insurance Fraud Division | Insurance fraud unit of the department | Division of Criminal Investigations of the Department of Financial Services |
| Immunity standard | "Without malice" | Lost for "malice, fraudulent intent, or bad faith" | Absence of "fraud or bad faith" and filing "without malice" |
| Statute | Ins. Code 1872.4 and 1872.5 | Ins. Code 701.051 and 701.052 | Fla. Stat. 626.989 |
California
An insurer must send the Fraud Division a report on a department form within 60 days after it determines, following its SIU investigation, that it reasonably suspects or knows an act of fraud may have occurred. The statute lists two situations where a report is not required: the first look suggested fraud but further investigation showed there was none, or the insurer and claimant agreed on the amount and the insurer has no reasonable grounds to think the claim is fraudulent. The law adds a consumer protection that deserves attention: if the insurer has no evidence that its own insured is involved in the fraud or the fraudulent collision when it forwards the information, it must take all necessary steps to make sure no surcharge is added to the insured's premium because of the claim.
Texas
The duty falls on "the person" who determines or reasonably suspects fraud, and the report must be in writing within 30 days. A member of an organization dedicated to detecting and prosecuting insurance fraud can meet the duty by authorizing that organization to report for it, though the member stays liable if the organization fails. Immunity covers information given to the department, other agencies, law enforcement, the NAIC, an insurer's special investigative unit and similar bodies, and does not apply to a person who "acts with malice, fraudulent intent, or bad faith."
Florida
Florida's approach is two-tiered. People who are not insurers or licensees "may" send information to the Division of Criminal Investigations, while insurers, agents and other licensees, as well as certain licensed professionals and medical review committees, "shall." The immunity is broader and more detailed than the others. It covers reports to the department, the division, the NAIC, the National Insurance Crime Bureau and law enforcement, and it expressly allows designated insurer employees who investigate suspected fraud to share information with each other across companies if the department has been told their names and job titles. That protection holds unless the insurer acts "in bad faith or in reckless disregard for the rights of any insured," and it is forfeited for the exchange or publication of defamatory information with third parties not authorized to receive it.
New York
New York's regulation on reports of fraudulent acts requires any licensee who determines that a transaction "appears to be fraudulent or suspect" to report it to the Insurance Frauds Bureau on a prescribed form; that section states no deadline.
Immunity is qualified, and the wording matters
"Immunity" overstates it. Every version carves out the bad actor, and the carve-out wording differs:
| Standard | Where | What it excludes |
|---|---|---|
| "Actual malice" (must be specifically pleaded) | NAIC model Section 7 | Statements made with actual malice |
| "Without malice" | California | Information not given without malice |
| "Malice, fraudulent intent, or bad faith" | Texas | Any of the three |
| "Absence of fraud or bad faith" plus "without malice" | Florida (reports to authorities) | Fraud, bad faith or malice |
| "Bad faith or reckless disregard for the rights of any insured" | Florida (insurer-to-insurer sharing) | Bad faith or reckless disregard |
In defamation law, "actual malice" is usually read to mean that the speaker knew the statement was false or acted with reckless disregard for whether it was true. Courts in different states may read these phrases differently; an attorney licensed in your state can say how yours does.
Two consequences follow. An honest mistake is generally protected: a report made on reasonable suspicion that later proves wrong does not by itself create liability. But the shield covers reports to the authorities and the entities the statutes list. An insurer that circulates an accusation to a neighbor, an employer or a shop with no role in the investigation does not get it; Florida says so explicitly for insurer-to-insurer sharing.
Anti-fraud plans and SIU staffing
Reporting requires someone to do the investigating. That is why many states also require insurers to maintain fraud units and file plans.
Florida. Under Fla. Stat. 626.9891, every admitted insurer must have a designated anti-fraud unit or contract the work out, adopt an anti-fraud plan, name a responsible employee and file all three with the division annually. The plan must explain the staffing level, which may rest on policies written, claims received, suspected fraud detected and investigator caseloads. Staff get at least two hours of initial training and one hour a year after that, insurers report fraud-referral data by March 1, and noncompliance can bring a fine of up to $2,000 per day.
California. The regulations tell insurers how an SIU is to run. Staffing adequacy is judged by the insurer's demonstrated ability to run a compliant SIU, given factors such as policies written, claims received and vulnerability to fraud. The SIU must keep written procedures listing red flags specific to each line of insurance, and must investigate each credible referral, meaning one with a red flag, including automated referrals, unless a preliminary review shows the flag is clearly not fraud. In that case it must document why in the claim file (2698.36).
New York. The regulation on fraud prevention plans applies to insurers writing private or commercial auto, workers' compensation or accident and health policies that write 3,000 or more such policies in a year, and requires a plan that includes a full-time Special Investigations Unit separate from the underwriting or claims functions, or a contract with a service provider that leaves the insurer primarily responsible.
For consumers, this machinery explains why an adjuster can sound as if a decision is out of their hands. Once a claim trips a red flag, a different department with its own procedures has the file. My claim is under SIU review: what to expect and your rights covers that stage from the claimant's side.
How fraud reporting meets the claims-handling rules
Reporting suspicion does not suspend the insurer's duty to treat claimants fairly. The two bodies of law operate at once.
The NAIC's Unfair Claims Settlement Practices Act (January 1997 version in the NAIC compilation) lists practices that become violations when committed flagrantly or often enough to indicate a general business practice. They include refusing to pay claims without a reasonable investigation, failing to affirm or deny coverage within a reasonable time after completing the investigation, and failing to promptly provide a reasonable and accurate explanation for a denial or compromise offer. In the model, enforcement runs through the commissioner: a statement of charges, a hearing, and a cease-and-desist order with penalties of up to $1,000 per violation (capped at $100,000 in total), or $25,000 per violation (capped at $250,000) for flagrant violations, and possible license suspension. Whether a state also allows lawsuits by policyholders varies; state law and an attorney are the places to find out.
The companion claims regulation (July 1997 version) contains the time limits, and also contains the fraud carve-out. First-party claimants are to be told of acceptance or denial within 21 days of proofs of loss; if more time is needed, the insurer must write with reasons and repeat the notice every 45 days. But where there is "a reasonable basis supported by specific information available for review by the insurance regulatory authority" to suspect that the claimant fraudulently caused or contributed to the loss, the insurer is relieved of those requirements, though the claimant must still be told of acceptance or denial "within a reasonable time for full investigation."
States tune that carve-out differently:
| State | Normal clock | If fraud is suspected |
|---|---|---|
| NAIC model | Accept or deny within 21 days of proofs of loss | Relief from the 21-day clock; a reasonable time for full investigation |
| California | Accept or deny within 40 calendar days of proof of claim; status letters every 30 days | Extended to 80 days, or suspended until the commissioner orders otherwise if the insurer reported under section 1872.4 and made a diligent attempt; insurer need not tell you it is investigating fraud |
| Texas | Written acceptance or rejection within 15 business days after receiving all required items; up to 45 more days if it explains why | The text read has a 30-day deadline for arson but no general fraud extension |
The California rules are in 10 CCR 2695.7, including a subdivision (b) saying an insurer need not disclose anything that could reasonably alert a claimant that the claim is being investigated as a suspected fraudulent claim. Texas's are in Insurance Code 542.056, and an insurer that violates the subchapter owes the claim plus 18 percent annual interest and attorney's fees for most claims (a different formula applies to property-damage claims under Chapter 542A).
What to do if you think you were reported unfairly
You will probably not be told that a report exists. Reports and bureau files are usually confidential, and California's claims regulation says an insurer need not disclose that a fraud investigation is under way. You will more likely see the effect: a stalled claim, requests for documents or a recorded statement, or a denial that cites misrepresentation. If that is happening:
- Read what you received. A denial must usually be in writing and cite the policy language. Compare the stated reason with what you said and submitted. See how to read a car insurance claim denial letter.
- Ask in writing for the status and the reason for the delay. Ask for the specific documents the insurer says it needs. Insurers cannot persist in seeking information not reasonably required, under California's rule on investigations.
- Correct any real error immediately, in writing. A prompt correction helps separate a mistake from fraud.
- Track the deadlines for your state. The clocks in the table above, and the notice of any time limit to sue, tell you when the insurer is late. how fast an insurer must respond to your claim: state time limits gives the wider picture.
- Complain to the department. Fraud bureaus handle crimes; the insurance department handles claims-practice complaints. See how to file a complaint against a car insurance company. A complaint does not stop an investigation, but it makes the insurer explain its handling to a regulator.
- Consider an attorney. If a denial accuses you of fraud, or investigators contact you, a licensed attorney can tell you how to respond and whether your state's immunity statute leaves any claim against the insurer.
If a report was malicious, meaning the insurer or an employee knew it was false, the immunity statutes above do not apply to it. Proving malice is difficult, because you usually cannot see the report, and the model act bars discovery of the department's records in private suits. That difficulty is part of the bargain these laws make.
A worked example
This is an invented scenario with made-up numbers.
Say a driver files a $9,000 theft claim on a car that disappeared from a shopping center lot. The adjuster notices the car had been listed for sale a month earlier. The SIU opens a file on day 12.
- In a California-style state, the 40-day clock runs from proof of claim. If the SIU reaches a reasonable belief that the claim is false, the insurer can extend the clock to 80 days and must report to the Fraud Division within 60 days of that determination, without telling the driver why it needs more time. If the SIU finds the driver was not involved, no report is required and the claim moves forward.
- In a Texas-style state, the insurer has 15 business days after receiving all requested items to accept or reject, and up to 45 more if it explains why. The reporting duty runs 30 days from suspicion. If the claim proves valid and stays unpaid past the statutory period, 18 percent interest and attorney's fees can follow.
In both, the driver's best moves are the same: respond to every request, keep copies, and ask in writing where the claim stands.
Common questions
Can I sue my insurer for reporting me to a fraud bureau?
Only in narrow cases. Where immunity applies, there is no liability for a report made without malice (or, in some states, without bad faith). If you can show that the insurer knew its statements were false or acted in reckless disregard of the truth, the shield falls away. An attorney licensed in your state can assess that; the standard varies.
Does a report mean I will be charged?
No. A report is a referral. A fraud unit reviews it and chooses which to pursue; Florida's statute says the division "select[s]" reports that in its judgment require further investigation, and a prosecutor must then decide whether to file. How a case moves forward is explained in how an insurance fraud case is prosecuted from referral to sentence.
Do ordinary people have to report fraud?
The statutes read here make reporting mandatory for insurers and other licensees and voluntary for the public. Florida's text says a person other than an insurer, agent or licensee "may" send information, and the NAIC model says the same. state insurance fraud bureaus: who investigates and how to reach them explains where to send a tip.
Can the insurer tell other companies about me?
Within limits. The statutes protect sharing among those involved in detecting fraud, such as other insurers' designated investigators, the NICB, and regulators. Florida requires the department to have been told the names and job titles of the employees who share. The claims databases covered in ISO ClaimSearch and how fraud analytics flag claims add another layer.
Key takeaways
- Most states require insurers to report suspected fraud to a state fraud unit; California's deadline is 60 days after the insurer's SIU determination, Texas's is 30 days from suspicion, and the NAIC model sets none.
- Immunity is qualified. Wording ranges from "without malice" to "malice, fraudulent intent, or bad faith," and sharing outside authorized channels can lose it.
- Insurers in many states must run SIUs under written procedures and file anti-fraud plans; Florida, California and New York regulate staffing, training or structure.
- Fraud suspicion can extend claim deadlines, as in California's 80-day rule, but the duty to investigate reasonably and explain a denial in writing remains.
- If you suspect a wrongful report, respond to every request, correct errors in writing, track deadlines, complain to the insurance department about claims handling, and consult a licensed attorney about any accusation.