An established fraud is not paid because it is established: it is paid to the extent that it is proved, and the gap between the two is what occupies files in this line. The insured arrives with a conviction, often correct, and accounts the fraudster worked on precisely so that they would show nothing. That conviction must be converted into an amount the insurer can pay without standing in for a judge, and it is work that is badly prepared after the event.
The first difficulty is that the burden of proof lies on the insured, as in all first-party insurance, and that it bears on three distinct things. The existence of a covered act, that is, one falling within the contract's list. The link between that act and the outflow of funds. And the amount of the loss, net of what has been recovered. A file that brilliantly establishes the first two and estimates the third settles on the low estimate, because an insurer does not pay an extrapolation.
The second difficulty belongs to long frauds and must be named: reconstruction. Four years of adjustment entries cannot be recounted by hand, and the company must produce a method rather than a figure. The accepted methods resemble each other: identify the transactions bearing the fraudster's signature, establish their fraudulent nature on a sample verified item by item, then extrapolate to the rest under an explicit and verifiable rule. A methodical extrapolation is accepted; an implicit one is refused, and the difference is that the first is written down.
One must then know what the contract excludes from quantum, since insureds often count on it. Internal costs, that is, the time the insured's teams spent understanding, are almost never covered. Forensic accounting fees incurred to establish the loss sometimes are, through a named and sub-limited extension, and it should be looked for before instructing the firm. Interest and lost profit are not. And indirect losses, such as a contract lost because the client learned of the fraud, fall outside.
The third difficulty is one of timing and it plays out in the first days. The evidence of a fraud is data: application logs, emails, backups, bank statements, system access records. It is overwritten, archived and purged under retention rules never designed for this. An insured that discovers on Monday and freezes on Friday has lost four days of logs. The first step, before even understanding, is therefore to suspend purges and take a dated copy, which costs nothing and cannot be recovered later.
The question of the employee must be added, and it is human as much as evidential. The company wants to dismiss quickly, and it is right to want to protect its funds; but a procedure conducted too fast can deprive the insurance file of its central element, the establishment of the act. An admission taken informally, a negotiated departure trading silence for a soft exit, a complaint not filed to avoid noise: each of those choices is understandable and each weakens the proof the insurer will ask for.
The discipline therefore comes to four steps in the first forty-eight hours. Freeze the data and date it. Notify, even without an amount. Check in the contract whether forensic fees are covered, before instructing anyone. And coordinate the internal procedure with the insurance file rather than running them separately, because they concern the same facts and one can damage the other without anyone intending it.
An agricultural cooperative discovers on June 3 that a storekeeper diverted goods over about five years, recording them as breakage write-offs. The management controller estimates the loss at 520,000 euros, applying the average sale price to the overall stock shortfall. The company dismisses the employee on June 12 after an interview in which he verbally admits the facts with nothing put in writing, and decides not to file a complaint to keep the local press out of it. It notifies on June 20. The insurer asks for proof of the acts, the calculation method, and the stock system logs; IT replies that those logs are kept on a rolling sixty days. The policy covers misappropriation by an employee, with a forensic fees extension sub-limited to 30,000 euros. Where does this file stand?
The principle of cover is not in question and that is almost the only settled point: misappropriation of goods by an employee falls within the contract's list. Everything else deteriorated in seventeen days, and it must be looked at item by item. Quantum first: 520,000 euros obtained by applying an average sale price to an overall shortfall is an estimate, not proof, and it is wrong by construction in its unit, since goods diverted cost the cooperative their cost price and not their sale price. An acceptable method existed: isolate the breakage write-offs bearing the storekeeper's identifier, verify a sample item by item, establish a rate, extrapolate under a written rule. It remains possible, provided the data exists, which is the second point. The system logs are kept on a rolling sixty days: as at June 20 only April and May remain, and the fraud runs over five years. Suspending the purges should have been the very first step, on June 3, before even understanding; it was not done and part of the evidential material is already lost. It should be requested today, which will save what remains, and for the rest one falls back on accounting documents and inventories, which are retained longer. The third point is the one the company will find hardest to hear: the unrecorded verbal admission and the decision not to file a complaint, both understandable, removed the file's central element. The insurer does not require a conviction, but it requires the act to be established, and a dismissal for gross misconduct with nothing in writing and no criminal follow-up leaves the cooperative alone to carry the demonstration. Two useful steps remain. Instruct a forensic accountant after first checking the 30,000 euro sub-limit, which bounds what will be reimbursed and is better known before signing an engagement letter. And reconstruct in writing the chronology from June 3 to 20, including the June 12 interview, because what was said that day still exists in witnesses' memory and will not in six months.
- 01An established fraud is paid to the extent it is PROVED: three distinct things, the covered act, the link to the outflow, and the net amount.
- 02On a long fraud one produces a method, not a figure: a sample verified item by item, a rate established, extrapolation under a written rule.
- 03The first step comes before understanding: suspend purges and date a copy. An insured that freezes four days late has lost four days of logs.
- 04Internal costs, interest, lost profit and indirect losses fall outside quantum; forensic fees are sometimes covered, sub-limited, and checked before instructing.
- 05An unrecorded admission, a negotiated departure, a complaint not filed: three understandable choices that remove what the insurer will ask for.