Fraud Detection

Identifies suspicious patterns across claims, enrollment, billing, and provider activity to flag potential fraud, waste, and abuse (FWA).

Overview

The Fraud Detection service analyses activity across Olly's core services to identify patterns indicative of fraud, waste, or abuse. It operates as a consumer of domain events: it doesn't block transactions but scores them and raises alerts for investigation.

Health insurance fraud takes many forms: phantom claims from providers who never saw the patient, duplicate billing for the same service, upcoding (billing for a more expensive procedure than performed), identity fraud during enrollment, and collusion between providers and members. The service needs to catch these patterns without creating false positives that slow down legitimate operations.

STATUS

This service is in the design phase. The architecture below is the planned direction; implementation has not started.

Fraud Categories

Category	Examples	Data Source
Claims fraud	Phantom claims, duplicate billing, upcoding, unbundling, impossible day surgery counts	Claims events, provider patterns
Provider fraud	Billing for services not rendered, referring to own facilities, credential misrepresentation	Claims + provider + care events
Enrollment fraud	Identity fraud, pre-existing condition concealment, retroactive enrollment gaming	Enrollment events, eligibility checks
Billing fraud	Premium diversion, payment fraud, refund abuse	Billing events, payment patterns
Pharmacy fraud	Prescription mills, doctor shopping, controlled substance patterns	Care prescriptions, provider referrals

Planned Architecture

Claims / Enrollment / Billing / Care / Provider
    │ (Kafka domain events)
    ▼
┌──────────────────────────────┐
│  Fraud Detection Service     │
│                              │
│  ┌─────────┐  ┌───────────┐ │
│  │ Rules   │  │ ML Scoring│ │
│  │ Engine  │  │ (Phase 2) │ │
│  └────┬────┘  └─────┬─────┘ │
│       └──────┬──────┘       │
│              ▼              │
│       ┌────────────┐        │
│       │ Alert      │        │
│       │ Manager    │        │
│       └─────┬──────┘        │
└─────────────┼───────────────┘
              ▼
     Work Management (tasks for investigators)
     Notifications (alerts to compliance team)

Phase 1: Rules-Based Detection

Configurable rules that flag suspicious patterns:

• Velocity checks: >N claims from same provider in X hours
• Duplicate detection: Same service code + member + date = likely duplicate
• Threshold alerts: Claim amount > £X for procedure type
• Pattern matching: Provider billing 7 days/week, member claiming from 3+ providers for same condition
• Geographic anomalies: Member location vs provider location vs claim date (boundary service integration)

Phase 2: ML-Based Scoring

Statistical models trained on historical claims data:

• Anomaly detection on claim amounts per procedure code
• Network analysis for provider-member collusion rings
• Predictive scoring for high-risk enrollment applications

Planned Data Model

Table	Purpose
fraud_rules	Configurable detection rules (condition + threshold + severity)
fraud_alerts	Generated alerts with score, category, evidence
fraud_investigations	Investigation lifecycle (open → investigating → confirmed/dismissed)
fraud_watchlists	Flagged parties, providers, or accounts under monitoring
fraud_scores	Per-entity risk scores (updated on each event)

Planned Events

Consumes

Topic	Purpose
claims.*	All claim lifecycle events for pattern analysis
enrollment.*	Policy and quote events for enrollment fraud
billing.*	Payment and invoice events for billing fraud
care.*	Appointment and prescription events for clinical fraud

Publishes

Topic	Purpose
fraud.alert.created	New fraud alert, triggering a work management task + notification
fraud.investigation.updated	Investigation status change
fraud.watchlist.updated	Entity added to or removed from watchlist

Integration Points

Service	Direction	Purpose
Claims	← consumes	Claim events for pattern detection
Enrollment	← consumes	Enrollment events for identity/eligibility fraud
Billing	← consumes	Payment events for financial fraud
Care	← consumes	Prescription/appointment events for clinical fraud
Provider	← reads	Provider details for cross-referencing
Boundary Service	← reads	Geographic plausibility checks
Work Management	→ creates	Investigation tasks for compliance team
Notifications	→ triggers	Alerts to fraud analysts

Open Questions

• Real-time vs batch? Phase 1 rules can run on each event (real-time). ML scoring may need batch processing on historical windows.
• Blocking vs advisory? Should high-confidence fraud alerts block claim payment, or always be advisory with human-in-the-loop?
• Data retention: fraud investigation data has different retention requirements than operational data. What are the regulatory constraints per market?
• Integration with external fraud databases: do we need to check against industry fraud registers (e.g., CIFAS in UK)?
• Privacy: fraud scoring on member data has GDPR implications. How does this interact with the consent service?

Design Doc

Not yet written. To be created during design phase.