Probability Is Not Proof: Why Insurance Fraud Is Becoming an Authorization Problem

AI tools can now clone a policyholder's voice, reuse their signature and complete their MFA. When that happens, the payout, distribution or policy change usually goes through, and the carrier finds out only when someone disputes it.

That shift was the subject of "Probability Is Not Proof: The Future of Fraud Defense," a panel at ITC Vegas 2026 with our CEO Pat Kinsel and Phani Aytam, Ventures Director at State Farm Ventures, moderated by Marissa Buckley of RevUp. Both speakers argued that carriers will increasingly have to show who authorized a transaction, which a fraud score can't do.

What has AI changed about insurance fraud?

Carrier workflows for KYC, consent and claims rest on a few assumptions. The person on the phone is who they say they are, a signed document is the one they actually signed, and the carrier controls its own login steps.

At ITC, Pat described how AI products now break each of those, often as advertised features. Voice clones take seconds to make. Some agents can find an old signed PDF in a person's inbox, copy the signature and submit a new application with it. Some AI companies run authenticator apps and complete MFA for their users.

The carrier's systems see a clean application or a routine beneficiary change. The problem surfaces months later, when the policyholder disputes it and the carrier has to produce evidence of consent it never captured.

Why are carriers treating fraud as an authorization problem?

When an AI agent acts for a policyholder, the account is real and the request is well formed, but nothing in the file records what the person actually approved. Most carrier systems check the login and stop there.

On the ITC panel, Phani Aytam of State Farm Ventures split the problem into a first mile, where a person gives an agent permission to act, and a last mile, where the business receiving the request confirms that permission before acting on it. He told the room that closing that loop is why State Farm Ventures invested in us. We've written more about this authorization gap in agentic commerce.

Why can't a fraud score settle a disputed claim?

A fraud score answers how likely a session is to be legitimate. A dispute asks who made the change and what they agreed to, and the carrier needs evidence it can hand to an examiner or a court.

Say a policyholder reports that they never changed the beneficiary on their life policy, and the session that made the change scored 0.94. That score shows the change looked normal when it happened, which does nothing to identify the person who made it.

A score also leaves the carrier holding all the work afterward. When a disputed payout lands on an investigator's desk, the score is one line in the file. What they need is a record of who approved the transaction and what they agreed to, and most carriers don't have one. So the investigator rebuilds it from call logs, emails and timestamps, months after the fact.

Before Proof, I spent more than a decade putting cryptographic identity on the things enterprises have to trust: employees, servers, connected devices and the code running on them. None of that trust rests on a guess. A certificate binds an identity to a key, and anyone can check it. That's why HTTPS works, and it's why your phone accepts a software update without wondering who sent it. The approval behind a payout should work the same way: signed to the transaction, checkable by anyone who needs to see it, and still intact when the dispute shows up.

What are carriers asking for?

Protect payouts and distributions

Large settlements, distributions and payee changes often go to people a carrier has never paid before, like a claimant's attorney, a contractor or a new beneficiary. The bank details arrive by email, and a callback is usually the only check. Business email compromise, where a fraudster slips new bank details into a legitimate payment, cost U.S. organizations more than $3 billion in 2025. And with about 55% of insurance payments still going out by check, most of the shift to digital payouts hasn't even happened yet. Every payment that moves to a faster rail ends up relying on a callback that a cloned voice can pass.

The approach I heard most often at ITC was a dollar threshold. Payees above it verify their identity before funds release, and payments below it keep running the way they do today.

Verify once, then reuse

A bank verifies a customer in the morning, and an insurer verifies the same person again that afternoon, with neither check building on the other. The carriers we met at ITC want to verify a policyholder once and rely on that identity for later beneficiary changes, wires and claims.

How does Proof help carriers prove who authorized a transaction?

We verify the policyholder once, to NIST IAL2, with deepfake and injection checks running during the session. That identity then carries through the rest of the policy, so a beneficiary change, claim or payout confirms the same person instead of starting over.

At each of those moments, the person approves the specific transaction, and we sign that approval to it. For high-dollar payouts, Transaction Signing ties the payee’s approval to the exact amount and account, so changed bank details need a new approval. Payments under your threshold keep moving the way they do today.

AI agents get the same treatment through x401, an open protocol we built that lets any website or API challenge an agent for verifiable proof of who it represents. When an agent starts a purchase, claim or policy change, the policyholder approves it in one tap.

Each approval leaves a signed record of who approved the transaction and exactly what they approved, which a carrier can hand to SIU or an examiner if a policyholder disputes it.

What will carriers need to prove?

Every insurance transaction should be tied to the verified person who approved it, whether they tapped the button themselves or sent an agent to do it. Carriers that can't show that will pay twice, once in the fraud that gets through and again in the friction they add to stop it. Phani had a shorter name for it on the panel: "fraud with friction, and that's very expensive."

Most carriers start with high-dollar payouts, where a wrong answer costs the most.

Talk to us about verifying the payees, claims and policy changes in your workflow >