Social media and surveillance in injury claim investigations

Yes, an insurer can read anything you post publicly, and it can have an investigator watch and photograph you in places the public can see. What it generally cannot do is lie its way into your private accounts, trespass, harass you or obtain protected records by impersonation. If you later sue, a court can order you to hand over even "private" posts that bear on your injuries, because courts look at relevance, not at your privacy settings. For an honest claimant the practical rule is simple: your public life should be consistent with what you told the insurer, and nothing relevant should be deleted once a claim exists.

Where insurers look first

An injury claim is a claim about what you can and cannot do. Insurers therefore test it against evidence of what you actually do. Large carriers run special investigations units (SIUs) for this, and many describe the toolkit in public. CNA, for example, says its SIU uses field work such as scene inspections and interviews, surveillance to gauge an injured worker's activity, and what it calls "social network data mining" to look for links between claimants, providers, attorneys and witnesses (CNA special investigations unit, read November 2026). Most injury claims never reach an SIU. An adjuster handles them, and extra checks start when something does not fit: a severe injury after a minor impact, a long treatment gap, or an account that shifts between tellings. The broader picture is in how insurers investigate fraud.

Social media is cheap to search. A claims professional can look up your name, your photos, your tagged posts and the posts of friends who tagged you in about the time it takes to read an estimate. In a 2012 Claims Journal report on an industry panel, one carrier said it involved legal counsel before allowing adjusters to use social media in investigations, and another said its adjusters had access under "strict guidelines" (Claims Journal, 2012). That article is old and describes practices at two companies, so read it as an indication that there are internal rules, not as a current industry standard.

How a post becomes evidence

A single photograph almost never decides a claim. What matters is whether a pattern contradicts a specific statement you made about your limits. Investigators and adjusters look for:

• Activity that conflicts with a stated restriction. You told a doctor you cannot lift more than 10 pounds, and a public photo shows you carrying a child on your hip or loading a heavy box.
• Travel and events. A check-in at a theme park, a gym or a distant city during a period you reported being housebound.
• Timing. Posts, comments or messages at hours or in volumes that do not fit a claimed inability to sit, concentrate or use a screen.
• Other people's content. Tags, event photos and videos posted by friends, which you did not choose but which carry your name.
• Connections. Shared acquaintances between a claimant, a treating provider and a lawyer, which can matter in organized-fraud cases rather than ordinary claims.

Context cuts both ways, and a careful reviewer knows it. A photo may be old. A trip may have been planned before the crash. A smile is not a pain score. One good afternoon after a bad month proves little, and many injuries fluctuate. Metadata matters: the date a photo was taken can differ from the date it was posted. The sensible claimant response to a post that looks bad is to explain it plainly, with dates and details, rather than to argue that it is irrelevant.

A worked example shows how the gap opens. Say you report a back injury and tell your adjuster you cannot sit for more than 20 minutes. A friend posts a public photo from a wedding, tagged with your name, in which you are seated at a table at the reception. The photo is not proof of fraud. It could mean you sat for a short while, stood up often, or took a break. But if you never mention the wedding and later the investigator surfaces the photo, the omission reads worse than the photo does. If you had said, "I went for 90 minutes, stood up several times, and paid for it for two days," the same photo supports your account.

What a public profile does and does not give up

What you post for anyone to see is generally fair for an insurer, a defense lawyer or a private investigator to view. Courts treat voluntarily shared posts as weak candidates for privacy protection. In Romano v. Steelcase Inc., a New York trial court in 2010 reasoned that a user who posts on a social network, where "neither Facebook nor MySpace guarantee complete privacy," has no legitimate reasonable expectation of privacy in the material shared there (opinion, 30 Misc. 3d 426). That is one trial court applying New York's discovery rules, not a nationwide holding, but its reasoning is typical of how courts view public content.

Private content is a different matter, for two reasons.

First, an insurer has no legal means to compel a social network to open your private account informally. The Romano court noted that the federal Stored Communications Act (18 U.S.C. 2701 and following) bars services like Facebook from disclosing account content without the account owner's consent. That is why the fight usually becomes a request that you sign an authorization or produce the material yourself.

Second, a claim is not a lawsuit. During a pre-suit claim, an insurer's formal tools are the policy's cooperation duties (recorded statements, medical records, sometimes an examination under oath in a first-party claim) and its own investigation. Compulsory discovery of your accounts happens only if the dispute reaches court. If you are unsure what the policy requires of you, the declarations and conditions sections spell out the duties; see recorded statements: when to give one and when to wait for how that works in practice.

What courts order once there is a lawsuit

Once a claim is in litigation, courts decide whether to order disclosure of social media content under ordinary discovery rules. The recurring principle is that the question is relevance, not whether the account is set to private.

New York's highest court on private accounts. In Forman v. Henkin, decided in 2018, a woman who said she had suffered spinal and traumatic brain injuries in a fall from a horse claimed she had become reclusive and had trouble writing. She had testified that she posted many photographs of her active life before the accident. The New York Court of Appeals rejected "the notion that the account holder's so-called 'privacy' settings govern the scope of disclosure," and held that the threshold question is "not whether the materials sought are private but whether they are reasonably calculated to contain relevant information." It reinstated an order requiring the plaintiff to produce her pre-accident photographs she intended to use and her post-accident photographs, excluding any that showed nudity or romantic encounters, plus data on the timing and number of characters in her post-accident messages, though not their content (opinion text, 30 N.Y.3d 656). The decision is a good model of the middle path: broad access was not granted, but relevant material was.

A trial court that went further. In Romano, the defendant pointed to public profile pages that showed the plaintiff smiling outside her home and describing travel, despite her claim of permanent injuries and being largely confined. The court concluded that this made it reasonable to infer the private pages held more relevant material and ordered access.

A court that said no. In McCann v. Harleysville Insurance Co. of New York, a 2010 appellate decision in an underinsured-motorist dispute, the court affirmed the denial of the insurer's request for photographs and an authorization for the plaintiff's Facebook account. It said the insurer "failed to establish a factual predicate with respect to the relevancy of the evidence" and was seeking "a fishing expedition... based on the mere hope of finding relevant evidence." It also held that the plaintiff should not receive a protective order barring any future request (opinion, 78 A.D.3d 1524).

Put together, these cases mean that a broad request for "your whole account" is vulnerable, a narrow request tied to the specific injuries you claim is not, and the outcome depends on the state and the judge. All three are New York decisions. Other states apply their own discovery rules, and a licensed attorney in your state is the person to ask about yours.

Deleting posts is the worst response

When a claimant sees a post that looks bad, the instinct is to delete it. Once you know a claim exists, that is risky. In Allied Concrete Co. v. Lester, a Virginia wrongful-death case decided by the Virginia Supreme Court in 2013, the plaintiff's lawyer directed a paralegal to tell him to "clean up" his Facebook page after the defense requested its contents, and the plaintiff deleted 16 photographs. The trial court gave the jury an instruction to presume that the deleted photographs were harmful to the plaintiff's case, and it sanctioned the lawyer $542,000 and the plaintiff $180,000 to cover the defense's fees and costs for dealing with the misconduct (Virginia Supreme Court opinion). The Supreme Court's opinion recounts those facts while deciding appeals about a new trial, juror conduct and the size of the verdict.

The lesson is narrow and practical. Once a claim is open, do not delete posts, photos, messages or accounts. Whether you may change privacy settings or stop posting is a question for an attorney, because the line between protecting your privacy and destroying evidence depends on your state and the stage of the dispute. Simply posting less, and posting nothing about your activity levels or the accident, is a conservative choice that harms nobody.

Surveillance: what a private investigator can do

Insurers hire licensed investigators to watch claimants, usually for a few days, usually when the file shows a gap between claimed limits and likely activity. The legal framework has three layers.

Licensing. Most states regulate private investigators. Florida, for example, defines "private investigation" in section 493.6101 of its statutes to include investigating "the identity, habits, conduct, movements, whereabouts, affiliations, associations, transactions, reputation, or character" of a person, and requires a Class C license for individuals who perform it (section 493.6201). Its section 493.6102 exempts "any insurance investigator or adjuster licensed by a state or federal licensing authority" acting within the scope of that license. Other states draw the lines differently, so licensing questions get answered by your state's licensing agency.

The tort of intrusion. The common-law standard comes from the Restatement (Second) of Torts, which makes a person liable for intentional intrusion on another's seclusion or private affairs if the intrusion "would be highly offensive to a reasonable man." McLain v. Boise Cascade Corp., a 1975 Oregon Supreme Court case from a workers' compensation claim, applied it to surveillance. Investigators filmed the claimant mowing his lawn, tilling a garden and fishing, from points near his property, and one probably crossed a fence. The court held that a person who claims injury "must expect that his claim will be investigated" and gives up privacy "to the extent of a reasonable investigation." It said surveillance conducted in a reasonable and unobtrusive way creates no liability, that unreasonable and obtrusive surveillance does, and that "trespass alone cannot automatically change an otherwise reasonable surveillance into an unreasonable one," while noting that trespass "to peer in windows and to annoy or harass the occupant may be unreasonable" (opinion, 271 Or. 549).

Statutes that bar deception for records. Federal law makes it unlawful to obtain a customer's financial-institution information through false statements, at least outside certain exceptions: 15 U.S.C. 6821 covers "customer information of a financial institution" and carves out insurance institutions conducting an investigation into "criminal activity, fraud, material misrepresentation, or material nondisclosure" that is authorized by state law. A separate federal law, 18 U.S.C. 1039, makes it a crime, punishable by up to 10 years in prison, to obtain someone's confidential phone records by false statements or by accessing accounts without authorization, with an exception in the text I read for lawful law-enforcement activity. In plain terms, an investigator who calls your phone company and pretends to be you has a serious problem, even if the insurer is paying the bill.

Pretext, friend requests and the ethics rules

The newest version of the old question is whether an investigator can send you a friend request. The best-known guidance comes from the lawyers' side. Formal Opinion 2010-2 of the New York City Bar's ethics committee concluded that a lawyer, or an investigator acting for the lawyer, may use a real name and profile to send a friend request without explaining why, but may not use deception or a false identity to gain access (NYC Bar Formal Opinion 2010-2). That opinion governs lawyers and their agents in New York, not every insurer or every state, but it shows where the ethical line sits: a truthful request you are free to ignore is different from a fake persona built to earn your trust.

For you, the practical advice is to treat any contact you do not recognize with suspicion while a claim is open. You do not have to accept a friend request, a follow, or a message, and you do not have to discuss the claim with anyone other than the people handling it.

How investigators document what they see

A surveillance report is a log. It typically records the dates and times watched, the locations, what the subject did in each interval, and how long each activity lasted, with timestamped video or photos. A few features help you understand how the footage will be read:

• Investigators film in public places or from places the public can see, as in McLain.
• They look for sustained or repeated activity, not a single movement.
• They watch for the activities your claim says you cannot do: lifting, driving long distances, bending, standing for long periods.
• The footage is compared with your recorded statement, your medical records and, in a lawsuit, your deposition.

Many claimants first learn that surveillance exists when footage is shown at a deposition, a mediation or an independent medical exam; see PIP and MedPay benefit cutoffs after an independent medical exam. Insurers are not required to tell you they are investigating you for possible fraud. California's claim-handling regulation, for example, says an insurer does not have to disclose "any information that could reasonably be expected to alert a claimant to the fact that the claim is being investigated as a possible suspected fraudulent claim," but also requires every insurer to "conduct and diligently pursue a thorough, fair and objective investigation" (10 CCR 2695.7). Check your own state's rules, which differ.

A consistency checklist for honest claimants

You do not need to change your life, you need an accurate record of it.

1. Describe your limits specifically and with their conditions. "I can walk for about 15 minutes before the pain builds" is more useful and more defensible than "I can't walk."
2. Say what you did that seems inconsistent, early. If you attended the wedding, tell the adjuster, with how long you stayed and how you felt afterward.
3. Keep a symptom and activity diary. Dates, what you did, and how you felt the next day show good and bad days honestly; see keeping a claim diary to protect yourself.
4. Do not delete anything related to the accident or your activities. Ask an attorney before changing settings or closing accounts.
5. Ask friends not to post or tag you in activity photos while the claim is open, and tell them why.
6. Be careful with recorded statements. Anything you say can be compared with what you did; recorded statements: when to give one and when to wait explains when to give one.
7. Follow your doctor's instructions, and keep appointments. A claimant who does far more or far less than the treatment plan calls for undermines both the claim and the recovery.
8. Do not exaggerate. Padding a claim is where an honest claim becomes a problem; see claim padding vs fraud: where the legal line falls.

Common questions

Can my insurer use a post a friend made about me?

Yes, if it is publicly visible, or if the friend gives it to the insurer. Posts and tags by others are outside your control, which is why asking friends to hold off during a claim is sensible.

Is it illegal for an investigator to follow me?

Following and photographing someone in public is generally not illegal, and McLain treats a reasonable, unobtrusive investigation as an expected part of making a claim. Harassment, trespass into private areas, peering into windows, wiretapping, and obtaining records by impersonation cross the line. The rules are state-specific, so a licensed attorney or your state insurance department is the place for specifics.

Do I have to give the adjuster my social media passwords?

A pre-suit claim does not usually give the insurer a right to your passwords. In litigation, courts decide what must be produced, and Forman shows that the order is typically tailored to relevance. Do not hand over credentials informally; ask what is requested, why, and whether it can be narrowed.

What if the footage makes me look better than I am?

Then you have a documentation problem to explain, not a reason to panic. Tell your doctor and adjuster about good days and bad days honestly. Surveillance that shows a person doing light activity for short periods is consistent with many genuine injuries.

Key takeaways

• Public posts, tags and check-ins are open to insurers and investigators, and a pattern that contradicts your stated limits is what draws attention.
• Courts decide whether to order disclosure of private accounts on relevance, not privacy settings, and broad "fishing" requests are often refused.
• Never delete posts or accounts once a claim exists; in Allied Concrete v. Lester deletion led to a jury instruction against the plaintiff and sanctions.
• Surveillance in public by a licensed investigator is generally lawful if reasonable and unobtrusive; trespass, harassment and impersonation to get records are not.
• The best protection for an honest claimant is accurate, specific statements about your limits and early explanations of anything that looks inconsistent.