Insurance Fraud Playbooks: Synthetic Scenarios for Safer Evaluation

By Gwylym Owen — 20–28 min read

Executive Summary

AethergenPlatform can provide synthetic playbooks—parameterized fraud scenarios that allow investigators and data teams to evaluate detection strategies safely without exposing protected health information (PHI) or personally identifiable information (PII). Each playbook includes evidence at operating points (OPs) and privacy probes, enabling procurement to sign off quickly and confidently as of September 2025.

Typology Library: Comprehensive Fraud Patterns

The typology library captures a wide range of insurance fraud behaviors, each with configurable parameters for realistic testing:

• Upcoding: Overbilling by specialty (e.g., cardiology), with a factor range (e.g., 1.1x to 1.5x normal rates).
• Unbundling: Splitting components (e.g., lab tests) with pressure to bundle (e.g., 80% bundling rate).
• Phantom Providers: Fake providers with distance/time collisions (e.g., claims from 50 miles apart in 1 hour).
• Doctor Shopping: Overlapping prescriptions with device reuse (e.g., 25% reuse rate across patients).
• Duplicate Billing: Repeated claims with delay windows (e.g., 7-14 days) and modifiers (e.g., +10% fee).
• Kickback Rings: Referral cycles with abnormal amounts (e.g., $500+ per referral).

Parameters: Customizable Scenarios

Playbooks are highly tunable to reflect real-world variability:

• Prevalence and Severity: Distributions for fraud frequency (e.g., 4% base rate) and impact (e.g., $1,000-$5,000 losses).
• Co-occurrence Rates: Probability of multiple typologies overlapping (e.g., upcoding with unbundling at 15%).
• Timing Windows: Adjustable periods for fraud events (e.g., 14-day windows for doctor shopping).
• Regional and Plan Overlays: Tailoring to specific insurance plans or geographic areas (e.g., higher prevalence in urban zones).

Evidence at Operating Point: Actionable Metrics

Each playbook delivers evidence tailored to operational needs:

• Detection at Fixed FPR Budgets: Performance at set false-positive rates (e.g., 1% FPR for 2,000 alerts/day), with confidence intervals (e.g., [0.75, 0.78]).
• Segment Stability: Consistency across regions (e.g., NA, EU) and specialties (e.g., orthopedics), with max deltas (e.g., < 3%).
• Cost Curves: Incremental cases per analyst-hour (e.g., 5 cases/hour at 1% FPR) to optimize resource allocation.

Privacy: Safeguarding Data

Privacy is paramount, ensured through rigorous testing:

• Probes: Membership-inference and attribute-disclosure tests with confidence intervals (e.g., MIA at 2% [1%, 3%], below 5% threshold).
• Optional DP Budgets: Differential privacy settings per policy (e.g., ε=2.0, δ=1e-6) with utility impact (e.g., -1% ± 0.5%), disclosed in evidence.

Playbook Generation: A Deeper Dive

AethergenPlatform automates playbook creation via a structured process:

1. Schema Design: Define fields (e.g., provider ID, claim amount) and privacy constraints in a designer tool.
2. Synthetic Data: Generate datasets with calibrated distributions and typology parameters, logged with seeds.
3. Evaluation Pipeline: Run models, compute OP metrics, stability bands, and privacy probes, generating plots and tables.
4. Bundling: Create a signed ZIP with `metrics/`, `plots/`, `configs/`, and `playbook.yaml`, including hashes.

Playbook YAML: Detailed Configuration

playbooks:
  upcoding:
    prevalence: 0.04
    factor: {min: 1.1, max: 1.5}
    specialty_weights: {cardiology: 0.3, orthopedics: 0.25}
  doctor_shopping:
    window_days: 14
    device_reuse: 0.25
    co_occurrence: {unbundling: 0.15}
  phantom_providers:
    collision_window: 1h
    distance_threshold: 50mi
  duplicate_billing:
    delay_range: [7, 14]
    modifier: 0.1
  

Case Study: Payer Fraud Detection

Scenario: A health insurance payer tested fraud detection using upcoding and doctor shopping playbooks.

• OP Definition: 2,000 alerts/day at 1% FPR, set with operations.
• Utility: +23% yield vs. legacy rules, CI [20%, 26%].
• Stability: 2.1% max delta across regions, within 3% gate.
• Cost: 6 cases/analyst-hour, up from 4.9 with rules.
• Privacy: MIA at 1.8% (CI [1%, 2.6%], below 5% threshold); no DP applied.
• Outcome: Procurement accepted with quarterly refresh and rollback SOPs after a 12-day review.

Case Study: Specialty Fraud at a Regional Insurer

Scenario: A regional insurer targeted unbundling and phantom provider fraud.

• OP Definition: 1,500 alerts/day at 0.5% FPR.
• Utility: +19% detection lift, CI [16%, 22%].
• Stability: 1.9% max delta across specialties, within 3% gate.
• Cost: 5.2 cases/analyst-hour, improving efficiency.
• Privacy: Attribute-disclosure at 1.2% (CI [0.5%, 1.9%], below 3% threshold) with ε-DP at 1.5.
• Outcome: Policy adopted in 15 days with evidence bundle filed.

Governance and Change-Control

AethergenPlatform ensures safe deployment:

• CI Gates: Fail-closed checks on OP utility, stability, and privacy before release.
• Change Logs: `.aethergen/change-log.json` tracks updates, signed per playbook release.
• Rollback SOPs: Predefined triggers and procedures, rehearsed during review.

FAQ

Can we tune prevalence on the fly?

Yes—parameters are exposed in Jupyter notebooks and dashboards for safe rehearsal and adjustment.

How do we avoid overfitting to synthetic quirks?

We use feature ablations and sanity checks; playbooks include intended use limits and stability metrics in evidence to guide real-world validation.

Can we share playbooks with auditors?

Yes—export as Parquet with schemas, and the evidence bundle includes seeds for regeneration and verification.

Glossary

• Operating Point (OP): Threshold for detection performance (e.g., 1% FPR).
• Playbook: Parameterized synthetic scenario for fraud evaluation.
• Evidence Bundle: Signed ZIP with metrics, plots, and configs for audit.

Closing

Playbooks make insurance fraud evaluations repeatable, safe, and auditable. AethergenPlatform delivers these scenarios with the proof buyers need, streamlining adoption as of September 2025.

Contact Sales →