AI Unemployment Insurance Identity Fraud Triage Playbook

A state UI agency processed 28,000 new claims in 30 days. Post-payment fraud detection flagged 1,400 claims: same IP addresses for multiple claims, SSNs belonging to employed or deceased individuals, and bank routing numbers shared across unrelated claims.

When to use this playbook

• Use this playbook when the decision looks like the situation above: A state UI agency processed 28,000 new claims in 30 days.
• It is a fit when you have source files in hand and need a structured, reviewable analysis — not a generic chat answer about "Unemployment Insurance Identity Fraud Triage".
• Do not use it as a substitute for licensed, legal, clinical, or authorized official judgment in the domain.

What you'll need

• Flagged claim data (claimant ID, SSN, IP, bank routing, claim amount, payment status)
• Employer wage record cross-match results
• SSA death master file cross-match
• IP address geolocation and clustering data
• State UI fraud prosecution criteria

Attachments: Documents (Documents)

You are a UI fraud analyst triaging 1,400 flagged potentially fraudulent unemployment claims. I am attaching:

Work only from the attached source files. If a conclusion is not supported, say so.

Produce:
1. Cluster the 1,400 claims by shared fraud indicators: same IP, device fingerprint, bank routing — identify organized rings vs. individual cases.
2. Identify claims where the SSN belongs to an employed or deceased individual — clearest fraud cases.
3. Calculate total paid-out exposure for confirmed fraud clusters vs. pending payments that can still be stopped.
4. Prioritize the 1,400 claims: payments already made (recovery) vs. pending payments that can be intercepted.
5. Tell me the investigative referral threshold and what to document for a U.S. Secret Service referral.

Call out where independent models are likely to disagree, and list follow-up documents a reviewer should request.

What to expect

• Fraud ring cluster analysis
• Confirmed fraud cases (employed/deceased SSN)
• Total paid exposure vs. interceptable pending
• Prioritized action list (recovery vs. intercept)
• Federal referral documentation requirements

Review before you act

• Validate this output against source files before relying on it: Cluster the 1,400 claims by shared fraud indicators: same IP, device fingerprint, bank routing — identify organized rings vs. individual cases.
• Validate this output against source files before relying on it: Identify claims where the SSN belongs to an employed or deceased individual — clearest fraud cases.
• Validate this output against source files before relying on it: Calculate total paid-out exposure for confirmed fraud clusters vs. pending payments that can still be stopped.
• Validate this output against source files before relying on it: Prioritize the 1,400 claims: payments already made (recovery) vs. pending payments that can be intercepted.
• Confirm every cited figure, date, counterparty, or requirement against the attached originals — models compress and can drop a qualifier.
• Treat disagreement between models as a review item, especially on classification, materiality, and recommended next action.
• Do not authorize an operational, clinical, legal, credit, or enforcement action solely because the models agree.