Digital Threats Are Hijacking the Insurance Claims Process

Pete Miller [00:00]: Welcome to Predict & Prevent! Today, we’re joined by Todd Kozikowski, CEO of 4WARN — a company that’s redefining how insurance companies detect and defend against a threat many carriers don’t even know exists.

What began as a question about why litigated claims against insurers in Florida were outpacing market share evolved into a company dedicated to monitoring the digital environment and providing clients with an early warning of emerging litigation threats.

With deep roots in the insurance and data intelligence space, Todd explains how tech-enabled claim instigation works and why waiting for a policyholder to file a claim can already be too late.

He also describes how bad actors – ranging from lead generators and referral networks to overseas cyber criminals – are quietly shaping the claims process through fraudulent websites, manipulated search results, and increasingly, corrupted AI responses.

If someone searched for your insurance company right now the way a frightened policyholder would after a loss — would they actually find you first? The answer might surprise you.

Pete Miller [01:50]: Well Todd, welcome to the podcast. I’m very grateful for your time. So just to help set the stage for our listeners, can you just share sort of what was the catalyst for launching 4WARN?

Todd Kozikowski [02:00]: Absolutely. And Pete, pleasure to be with you and the audience today. So 4WARN really started with a question, not a product idea. Joe Petrelli and the team at Demotech, a rating agency, were examining the failure of several Florida focused property insurers. And in the process, the normal kind of financial actuarial catastrophe and CAT data were showing the pressure down in that state, but it didn’t really fully explain why litigated claims were growing so far beyond the insurers in that area and their share of market. And so Joe called me and he asked me a very simple question, you know, what’s changing? You know, is there something happening outside the carrier that its own systems cannot see today?

And that question, Pete, really became the starting point for 4WARN. So, in the spring of 2022, I began looking at the claim files and really also beyond that, but into the looking at the data beyond the public kind of what I would call the public digital environment surrounding Florida property insurers. And really within days and weeks, we found insurer-specific search campaigns, paid advertising, cloaking websites and doppelganger sites. We saw public adjusters, law firms, lead generators, intake sites, all working together to compete for policyholders and their first opportunity to find them to engage. And in fact, it was really, in one example, one public adjuster alone was spending almost $650,000 on search terms, targeting a very specific insurance company, all to start a claims journey.

The research for us exposed a major blind spot. And we knew insurers had really good tools for evaluating risk, but what they were missing was this kind of outside activity and the visibility around this. And so we wanted to make this measurable and certainly measurable not just within Florida, but provide intelligence across all markets, all lines across the company, the country.

Pete Miller [04:11]: Yeah, that’s fascinating. because you don’t often think of things outside of the whole claim, like the intake to the claims process, effectively, right?

Todd Kozikowski [04:19]: That’s exactly it, yeah.

Pete Miller [04:20]: 4WARN has used the term “tech-enabled claims instigation” to describe sort of what you’ve uncovered. Maybe we could just dive into that a little bit. So can you describe that problem and why, you know, for an insurance company to wait for a policyholder to file a claim might already be too late.

Todd Kozikowski [04:37]: Yeah, great point. so tech-enabled claim instigation is really the use of digital tools, data, content, the networks involved to really identify and influence people around a loss. So it can involve things like search advertising, social campaigns, lead generation sites, referral networks, all to capture someone who might be just simply looking for help. How do I file a claim? What’s my claim worth? Do I have a claim? And so you know, typically when you think about it, most people when say a tree falls on the roof of a home, we may not have the claims department phone number stored on our phone. I certainly don’t. And so for you know, for my insurance company, I may turn to a search engine and look up that number. And right then and there is where the journey begins because you’re looking for help as a policyholder, but what you get may not be necessarily the insurer’s information. You might start to see advertisements. You might be seeing a link to a from a lead generating site to see if you need help with your claim. It might be a public adjuster or a contractor. So they’re already engaged, but they also might be shaping the narrative of what you do next. You might file a claim directly with your carrier, but you also might engage with one of these actors and maybe start a different process. It could be a first notice of loss. So this is where 4WARN is watching all of the digital activity that occurs before the claim ever appears in a carrier system. We’re helping to try to understand who is targeting your policyholders, how are they getting solicited? Are there any intake paths that are being misrepresented or exploited? Is the activity increasing in certain markets and geographies that you know you might want to pay particular attention to. Right. We see things like compromise of you know, policy language being used to drive marketing campaigns. So we’re getting ahead of this at 4WARN and understanding that journey before it becomes a claim.

Pete Miller [06:48]: So can you just walk us through how 4WARN like intercepts and then analyzes and disrupts, I guess importantly disrupts these digital threat networks? Like when you talk about digital threat networks, we’re not just talking about aggressive lawyer ads, right? It’s beyond that.

Todd Kozikowski [07:05]: Yeah, I mean you can’t of course you can’t drive anywhere in this country, and I know you’ve seen this Pete, you can’t drive anywhere in this country without seeing a billboard. And the crazy thing is that for every dollar being spent on a billboard, about $25 more is being spent in digital targeting. And so this rarely represents this digital threat that we’re talking about. It’s and it’s not any one single advertisement or law firm. It can it can include things like lead generators. Marketing agencies, referral businesses, right? We see auto-body shops, medical groups, medical providers, you know, all involved in this kind of digital infrastructure. And so individually, those pieces may look unrelated, but the network becomes visible when you connect the shared data signals. And this is what we’re doing at 4WARN. You know, there’s analytics around those interactions, those signals between people, and their digital accounts, their referral pathways. And so, you know, if you think about it, after a hailstorm or a hurricane, I’ll give you a great example. Back a couple of years ago when we were first starting out, we were looking at Hurricane Ian, if you remember Hurricane Ian. And it hit the Florida coast. But way before it hit the Florida coast, we were watching websites pop up days before, people were bidding on search advertising for placement to be in that top search position. And they were setting up websites saying, hey, Pete, file your lawsuit now before the storm. So you’re first in line and you can get paid first as well. And so clearly fraudulent, clearly wrong. And so from our perspective, we’re detecting this, we’re preserving these public signals so that it can be used for validation and more importantly, you know, for the claims team, the SIU team, legal, marketing, IT, they’re all now working from the same perspective of where they see this risk and how to actually adjust their strategy.

Pete Miller [09:06]: You know, as you mentioned, Todd, I have and many of us have gone around the country and seen certainly seen attorney billboards, and I don’t hear you’re saying you’re anti-attorney because it has a has a role to play. But talk to us about how you view attorneys in the context of an insurance industry.

Todd Kozikowski [09:22]: Absolutely. We are not suggesting that, you know, legal advertising or representation is inherently bad. People have a right to legal counsel and most attorneys and advertisers are operating very legitimately. Our role is not to judge that profession, but our role is to measure the digital risks that are inherent in this environment that we’re seeing. And when we see actors and opportunists, the small percentage of the bunch take that step over the line where they’re creating these fictitious websites, making misrepresentations, using money to coercively target individuals with again misleading ads. This is where you know that draws the line. And truthfully, too, this hurts the legal profession. And it makes their job harder to try to stay above water when you have this type of competition and friction in the marketplace.

Pete Miller [10:19]: So Todd, when you thought about 4WARN, how did you differentiate your approach from earlier tools that somewhat claim to do similar things?

Todd Kozikowski [10:28]: Yeah, so traditional claims fraud, cyber litigation tools, they generally work from what I would call is from the inside of the organization. and they have an important role to play, there’s no question. They analyze claims, files, transactions. 4WARN works from the outside in. We are monitoring literally trillions of public digital signals, activity, right, that leads to the production of a claim, a lawsuit or fraud, a brand incident where somebody’s using your name and you know, and or even a cyber alert. And so the analogy I like to give is to think of it as like a zero-day cyber threat. You know, the vulnerability can be active before the organization even knows there’s a way to respond to it. And the same concept applies, you know, in our world in insurance. If a new fake claims website emerges that’s got insure specific advertising. It uses the name, the marks, the logos. It feels like the company. And there’s a coordinated kind of network to help target policy holders to bring them into drive claims. You know, this is where we are picking up those signals very early on as an early warning radar and helping to share that information with carriers so they can respond, mitigate, maybe it a takedown request, a cease and desist, or maybe even further legal action. and so we are monitoring this at scale across the country.

Pete Miller [12:01]: In reviewing your website, one of the things I thought was really cool was the litigation risk score. Can you tell us how an underwriting or a claims team would use that metric in in their day to day workflow?

Todd Kozikowski [12:13]: Yeah, so the 4WARN risk score is I think of it more as kind of a prioritization tool. And so Pete, what it allows us to do is show the level, the direction, the source of outside digital pressure around a company, a market, could be a service or even a specific geography. And the score is broken down into really four core categories, like a compass. The first is around digital targeting. So across a carrier, who are the actors that are involved currently that are directly targeting the company? How are they using your brand, your marks, your logo? But more importantly, are they setting up doppelganger sites? Are they trying to lure people into these new intake funnels? Are they using cyber tactics that you know intercept people to try to drive them into a coercive relationship?

The second is the magnitude of the scale. So no two opportunists are created equal. So they have different resources, they may have funding, they may have really sophisticated digital schemes and frankly skills that others may not have. So we measure the magnitude of these actors. The third is what we call a future-looking number, which is around the network risk. So, depending on where your business operates, what markets you’re in or hope to be in, how do we calibrate this digital risk appropriately for underwriting? And so we are measuring all of the actors right down to a ZIP code level of who plays in the digital ecosphere of that ZIP code. And then the last part is really your kind of technical vulnerability. As a business, we all have a kind of house that we have to maintain in order from our websites, our domains. So how are we protecting that in the face of all of these different digital instigators and cyber threats that are very real.

And so we measure those four components into a litigation risk score. And the score gives an organization from a 4WARN perspective a shared way to prioritize this external risk across departments. Because the challenge oftentimes is, you know, who’s watching this? What do you focus on? Where do you deploy resources? And so it’s really about again helping organizations respond to those core problems first, develop strategies around them, and then certainly build a more resilient, what I call a kind of better digital mote around the business.

Pete Miller [14:44]: So when you think of that, when you think of the mote and the preventative things, so what kind of results have your clients seen? Like can you share a couple stories where, you know, you helped maybe save a spike in a lawsuit or reduce payouts?

Todd Kozikowski [15:00]: Yeah, this is my favorite part because none of this matters unless it brings results. And so our clients have seen some amazing measurable reductions. I think first and foremost, what comes to mind is Louisiana Citizens, insurer of last resort, Richard Newberry, who’s the CEO, engaged with 4WARN a couple years ago in the wake of several hurricanes and he could see claim litigation frequency just spiking quarter over quarter. And he really was at wit’s end to try to figure out and understand why. How can they get ahead of this? And at 4WARN, in a short period of time of engagement, in just three months, we dropped their litigation rate by one percent, which for Richard was almost a $9 million savings. So that was real money for them. And what it did further was it hardened, if you will, their technical infrastructure in terms of how they present their brand, their name online. Before that, they talk in publicly, they’ve shared their website and several pieces of content were targeted by cybercriminal organizations operating out of Eastern Europe and they were using this to create malware and phishing schemes to drive people to get people to phish for information. So they had a real remarkable change in just a short period of time.

PCH Mutual, who provides a risk retention group that provides insurance to senior living facilities, they too in just a short period of time reduced their 4WARNed risk score by over 40 percent reduction in litigation rates, reduction in in their targeting by over 50% online in just a short period of time and they just continued month over mont, quarter over quarter continue to drive that risk down. And we’ve had other clients in other industries as well but we also even have had reinsurers begin to use this to see across their portfolio how does risk change, how does it transfer who are the organizations that that they can now help protect through better alerting.

Pete Miller [17:16]: Yeah, that’s really amazing. So if the return on investment is this clear, like I always wonder what are the friction points that you run into when you’re talking to carriers, ’cause it’s obvious you know, it’s very clear risk and you’re getting great results. So, where or what are the friction points?

Todd Kozikowski [17:32]: Yeah, you know, and we get it. We came out of this, nobody knew who 4WARN was. We’re a small organization at the start, but many of us had been in this industry before and we had seen a lot of these pain points. but I would say the biggest challenge is usually not implementation, because we’re a product that actually doesn’t get implemented. It really is in deciding who owns this risk, Pete, in an organization. Because the activity is happening, you know, outside the four walls of the company, a carrier may not necessarily understand if it’s a claims issue, a fraud issue, a legal issue, a marketing issue, could be a cyber/IT-related issue, but it doesn’t fit neatly into anyone team’s budget or their workflow or you know their organizational mandate. So to give you an example, you know, if a fake claim website comes into be you know into creation  marketing may see it as a brand issue. IT may see it as some type of domain or security risk. Legal may see infringement or you know consumer deception. Claims certainly will see it, you know, concerned as you know, policyholders are being diverted away. And then SIU may come in to understand: well, is that intake information? You know, how are they using it? Where is it coming from? So every team has a right to that information, but no one team naturally owns this. So if we’re warned, what we’re trying to do is give teams a shared outside-in view, a common set of facts, and a prioritized list of actions, as well as supporting artifacts to help them document what we’re seeing and what actions they can take on and have responsibility for protecting the organization.

Pete Miller [19:18]: So where is 4WARN headed? I mean you know, these threats and sort of the technologies evolving very quickly. And I understand, you know, when you think 4WARN going forward that insurance companies aren’t the only market facing this problem.

Todd Kozikowski [19:32]: Yeah, 4WARN is moving towards you know faster alerting for our organizations, stronger monitoring of AI-generated answers. If you think about AI today, we are obviously looking at things like deep fakes and synthetics, but we’re actually more concerned about how it’s shaping our search and the citations that come from them. And so we are looking at understanding and connecting the dots of those actors that are using it as a false narrative, as a narrative control. So the future is less about monitoring anyone, you know, insurance product or the risk event itself. It’s really about detecting the digital activity earlier as it’s shaping with an event, and then how it connects those kind of actors, the bad actors, and preserve all of the sensitive information to help to help carriers.

You know, going back to that example with the hurricane hitting Florida, you know, now we even see every year when NOAA names their storms at the top of the year, we see bad actors essentially buying up and creating websites like HurricaneArthurLawyer.com. And so they will bid on that. They will create websites that we will actually look at who’s creating those sites? Some cases they haven’t yet published, but they have them sitting on servers. Our crawlers, our work that we do are seeing that information. And so we’re beginning, we’re not saying it’s illegal, we’re not saying it’s fraud. We’re just looking at how they are going to solicit and how are they going to use these sites. And in some cases, Pete, as we found in working with departments of insurance, we do find fraudulent sites. And when we do, we’re working with our law enforcement group parties and partners as well as federal agencies to have these sites removed ahead of time so that more so we can get ahead of fraud, but also to protect the consumers and the policyholders of that state.

Pete Miller [21:35]: So Todd, you’ve found, I understand, that local firms are employing nation-state cyber criminals from overseas to help target U.S. policymakers. This is fascinating and scary to me.So how does how does a local insurance claim turn into a geopolitical cyber threat?

Todd Kozikowski [21:52]: Yeah, this is a campaign aimed at a local insurer or even a policyholder, you know, they now rely on infrastructure that’s located everywhere in the world. And that may include overseas websites, hosting providers, backlink networks, bots that are built to kind of coerce. And so this is all around using these tools, what we would normally treat as kind of cyber, but now being used to create fraudulent claims and and stealing of information, people’s identities, and so on. To give you an example of this, we have a client who is a well-known MGA. Their website was carbon-copied, hosted off a server in Norway, and it was an old banking server. And that server had kind of domain credentials, if you will. It had what we call a domain authority, its kind of searchability in the eyes of search engines, and a group of bad actors were able to commandeer that domain. They set up a fictitious doppelganger site that looked, smelled, and operated just like the insurance company. and as an MGA, they’re of course managing services on behalf of other carriers. So they were not only selling insurance, but they were managing claims across multiple brands. And there they were trying to harvest people’s information to then be sold into the dark web.

And so 4WARN is seeing this type of infrastructure. We’re connecting the dots both here domestically and internationally. And here’s where you know we’re certainly working with law enforcement. If we can work to do an early domain takedown to work with international partners as well, but more importantly, consumer warning to give organizations a chance to notify their policy holders or departments of insurance to warn their ecosystems, their state systems about these types of emerging patterns.

Pete Miller [23:48]: Yeah, that’s really amazing if they had a valid digital certificate and domain authority. That’s supposed to be like very foolproof, actually. So good, I mean, that’s an awesome service you provide. Just one other thing. You had mentioned about the how this can actually change Internet search itself. So, can you just drill in a little bit on that? So how are they corrupting conversational AI to steer policymakers away from carriers.

Todd Kozikowski [24:14]: Yeah. I love this question, Pete, because it I’m always trying to share more about AI in the sense of it, you know, we think of it as receipts and you know, doctoring of images and so on. But it’s AI is becoming the new front door for claims information, in my opinion. You know, after an accident or a loss, people increasingly now ask AI assistants what to do, right? Who to call, whether they need an attorney, how much their claim may be worth, like we were saying before. And if you look at the old path, traditional search normally gave people and a user a page of choices, those blue links that you would click on. Today with AI, it synthesizes all of these sources into one direct answer. So, it makes the quality and the origin of that information much more important. And if you have bad actors who are creating third-party websites that specifically aim to deceive, to spread false narratives about a particular brand like a carrier, you that information can be ingested into an AI and spread. Many large language models and AIs, they resort into looking at other AIs for information as well. So if one has it, it’s kind of a domino. It hits the others as well. They assume that into their into their model. And so 4WARN is monitoring what major AI and search platforms are saying, what are those citations going to? Who are the actors that are saying or corrupting it? And more importantly, you know, how does this steer the claims process and insurance risk downstream? These are the areas that we focus on the four one.

Pete Miller [25:55]: Yeah, that’s fascinating to me, Todd, because you know, as you well know, if a fraudulent AI company develops more and more fraudulent content, then that becomes a volume game and the large language model goes and learns and it then naturally by the prediction algorithm goes to the fraudulent site. Right. So your service’s even more valuable because you gotta cut that off really quickly and completely, right?

Todd Kozikowski [26:24]: Absolutely. Yep. Very much. Yeah.

Pete Miller [26:26]: So Todd, listening to this podcast, let’s suppose I’m the you know, a C suite at an insurance company and I’m, in my view, correctly concerned about this. What is the thing I should do tomorrow morning when I come into the office?

Todd Kozikowski [26:39]: Yeah, search for your company the way a policyholder or a claimant would immediately after a loss. Not the way your marketing department normally searches for your brand. Use the questions a frightened or a confused policyholder would naturally ask. You know, how do I file a claim? What should I who should I call? Where should I what should I do after an accident? is the damage covered? And then do the same set of questions, but use an AI assistant. And what I that exercise is so valuable because it provides a useful snapshot. And what’s interesting is you’re doing it from one ZIP code. Now imagine trying to do this at scale. And this is where 4WARN, you know, is performing the same type of surveillance, but at scale across thousands of keywords and searches, locations, actors, domains. We sift through 21,000 actors across 2,200 companies on a daily basis. And we’re using nearly a trillion data points to look at, you know, how advertisements are forming, how are they shaping or being bid on and those AI citations. So the goal is to make sure someone else is not quietly defining your company’s claims journey for its policyholders.

Pete Miller [27:57]: Todd, thank you very much for your time. This is fascinating and very in line with predict and prevent and I think, you know, your foresight in seeing this as a problem is really amazing because I don’t think a lot of carriers think about this.

Todd Kozikowski [28:11]: Thank you. It’s a pleasure to be here. And again, we are trying to get that awareness out for carriers and policyholders alike because the one thing we do know is technology doesn’t change. It keeps pushing forward. AI is completely putting that into a much faster acceleration. There’s a lot we don’t know about AI. What we can say though is that because of that, it creates a whole new level of risk. And how that risk gets transferred across different departments to respond, that’s where we feel at least we can capture some of that from the front end before that policyholder provides a claim, creates a claim, or worse, it becomes a lawsuit or deeper.