We’re seeing increased reports of synthetic medical claims fraud – how exactly are fraudsters using artificial intelligence (AI) to fabricate medical documentation and patient imagery today?

The short answer is they’re doing everything you’d expect and doing it well. Generative AI has made it trivial to produce convincing clinical notes, therapy records, diagnostic imaging, and medical necessity documentation from scratch. What used to require forging a doctor’s signature and hoping nobody looked too closely can now be done in minutes with off-the-shelf tools.

We’re seeing fully AI-generated progress notes submitted as part of claims packages. We’re seeing fabricated diagnostic images where lesions are added or removed to support a claim narrative. We’re seeing synthetic identities built out with years of fabricated medical history: if the claim is for a cardiac event, the fake patient’s records conveniently show years of hypertension and chest pain leading up to it.

The most sophisticated operations blend real and fake content or taking a legitimate medical record and inserting AI-generated sections like a fabricated specialist consultation or an invented lab result. That’s far harder to spot than a document that’s fake end to end.

What makes healthcare particularly vulnerable to deepfake-driven fraud compared with other sectors like banking or e-commerce?

Healthcare runs on documents. Banking has moved heavily toward real-time transaction monitoring and biometric authentication. E-commerce has chargeback systems and delivery verification. Healthcare still depends on someone submitting a PDF or a scanned image and another person reviewing it, often under enormous time pressure.

There’s also the complexity problem. A banking transaction is relatively simple to verify. A medical claim involves layered clinical narratives, diagnostic codes, provider credentials, treatment timelines, and supporting imagery that all need to be internally consistent. That complexity creates more surface area for fabrication, meaning more places to hide synthetic content where reviewers won’t catch it. And healthcare fraud in the US alone already costs tens of billions annually. The payout-to-effort ratio for fraudsters has shifted dramatically now that AI handles the hard part.

From a technical standpoint, what are the biggest challenges in detecting deepfakes within medical media and documentation?

The biggest challenge is that generation technology is improving faster than most detection approaches can keep up. The latest models are far better at simulating physics-accurate reflections and realistic tissue textures than what we saw even a year ago.

The payout-to-effort ratio for fraudsters has shifted dramatically now that AI handles the hard part

Detection of these materials has to be fast enough for real-time triage at scale, as insurers processing millions of claims can’t run deep forensic analysis on every submission.

Are there specific red flags or inconsistencies that insurers and claims processors should be trained to look for when verifying medical evidence?

There are patterns worth watching for, though I’ll be honest: relying on human reviewers to catch well-made synthetic content is increasingly unreliable. Even when people are warned about deepfakes, only about a third can reliably identify them.

That said, there are signals that should trigger escalation. Clinical narratives that are unusually uniform in tone. Missing or inconsistent data. And cross-referencing is critical: does this patient’s history tell a coherent story, or did it appear fully formed overnight?

The most important red flag is behavioural. Providers showing unusual documentation volumes, or documentation that’s suspiciously consistent across many patients, often indicates a systematic operation.

How effective are current deepfake detection tools in real-world insurance workflows, and where do they still fall short?

Detection technology has gotten significantly more capable, and we’re seeing real deployment in insurance workflows. Yet there’s a continuous arms race: as detection models improve, generation models adapt. Detection needs to be treated as a continuously evolving capability, not a one-time deployment.

The other gap is integration. Many insurers still treat fraud detection as a separate step rather than embedding it throughout their workflows. Detection is most effective when it’s running at the point of ingestion (at the point of upload, when media hits a platform or call centre, not after it is sent).

Given your background in cybersecurity and financial services, how do you see AI-driven fraud evolving across insurance in the next two to three years?

It’s going to get worse before it gets better. Deloitte projects US$40 billion in US fraud losses from generative AI by 2027. Industry analysts are projecting triple-digit percentage growth in deepfake attacks against insurers year over year.

The shift I’m watching is from opportunistic fraud to industrialised fraud. Over the next two to three years, we’ll see more organised operations combining synthetic identities, AI-generated documentation, and deepfake voice or video for live verification steps. The entire claims life cycle will continue to face synthetic content at every touch point.

Agentic AI is the next frontier. We’re already seeing early examples of autonomous systems that can manage multi-step fraud schemes: file the claim, generate supporting documentation, pass voice verification on a follow-up call. The cost and skill required to produce convincing fake evidence has dropped to nearly zero, while the potential payout remains high.

What steps should insurers be taking now to future-proof their claims processes against increasingly sophisticated synthetic fraud?

First, deploy detection at the point of ingestion, not after payment. Every image entering the claims pipeline should receive an authenticity score before a human reviewer sees it.

Second, move to multi-modal verification. Cross-reference materials against provider behaviour patterns, claims history, and external data sources. Don’t rely on any single evidence type.

Finally, train your people, but don’t rely on them as your primary defence. The volume and sophistication of AI-generated fraud has moved beyond what manual review can reliably catch.

Do you see a role for industry-wide collaboration or regulation in tackling this issue, and what might that look like in practice?

Absolutely. The EU AI Act classifies synthetic media used for deception as a high-risk application, with transparency requirements taking effect this year. In the US, 46 states have enacted deepfake legislation, and the federal TAKE IT DOWN Act became law in 2025. The regulatory trajectory is clear.

The biggest challenge is that generation technology is improving faster than most detection approaches can keep up

Yet regulation alone won’t solve this. What the insurance industry needs is the kind of information-sharing infrastructure that financial services built through organisations like FS-ISAC. Fraud patterns and detection intelligence need to be shared across carriers, not treated as competitive intelligence. A fraud ring targeting one insurer is almost certainly targeting others with the same playbook.