Insurance Claims & Cybersecurity Risk Pack

Why this Data Set exists

Building a fraud-detection or supervisory-monitoring model requires labeled adversarial examples — and most institutions have very few. The labels in production data are sparse (fraud is a low-base-rate event, and many fraud events are never identified or never labeled correctly), the structural diversity of attack patterns is high (each new fraud scheme creates a new pattern type), and the regulatory pressure to detect new scheme types is increasing (FinCEN AML rules, FINRA elder-abuse rules, SEC supervisory expectations).

The alternative — building a synthetic adversarial corpus — has its own challenges. Generic synthetic data tends to under-represent the structural complexity of real fraud (the cluster of small signals that together indicate a fraud event). Hand-built adversarial examples tend to converge on a small number of attack types the team happens to think of.

This Data Set is a focused 50-household corpus where the adversarial scenarios are carefully calibrated against published FinCEN AML typologies, FINRA elder-abuse case studies, and CFPB predatory-lending enforcement actions. Every household carries explicit fraud-scenario labels, structured insurance-claim disputes, account-takeover patterns where applicable, and the markers that supervisory systems should detect. The corpus is high-deviation by design — for adversarial ML training, you want the cases that stress the model, not the cases that confirm it.

Use Cases

Who uses this Data Set

What's inside

The 50 households cluster around three archetypes deliberately chosen for adversarial-data utility: medical-debt-crisis households (S-03) where insurance-claim disputes are central; low-income working families (U-02) where predatory-lending exposure and AML-relevant transaction patterns concentrate; and neurodiverse / disability households (X-04) where elder-abuse-precursor markers surface (the disability-status field overlaps with cognitive-vulnerability flags in important ways).

Every household carries structured fraud-scenario labels — the scenario type (claim dispute, ATO, predatory loan, elder financial abuse, AML-suspicious-pattern), the structural markers that should trigger detection, and the resolution outcome (where applicable). Insurance-claim disputes include the disputed amount, the dispute reason (medical-necessity, pre-existing exclusion, treatment classification), the carrier and provider responses, and the resolution status. Account-takeover scenarios include the structured attack pattern (credential origin, authentication anomalies, behavioral changes post-compromise). AML-relevant patterns are calibrated to current FinCEN guidance — structuring patterns, unusual-pattern velocity, geographic-anomaly transactions, third-party-funded purchases.

The Data Set ships as JSON, CSV, and Parquet. The WealthSynth Methodology PDF documents the fraud-scenario taxonomy, the calibration sources (FinCEN advisory bulletins, FINRA elder-abuse case studies, CFPB predatory-lending enforcement actions, NAIC fraud-detection guidance), and the AML/elder-abuse markers that should drive supervisory routing.

Preview a sample household

A redacted summary of one household from this Data Set — names, employers, exact balances, and metro area are stripped. Ages are bucketed, income and net worth are reported as bands. The full record (and all 50 like it) ships in the ZIP.

Technical Highlights

Sample Schema Fields

{
  "fraud.scenario_type": <value>,
  "insurance.claims_history[]": <value>,
  "fraud.account_takeover_flags": <value>,
  "compliance.aml_flags": <value>,
  "fraud.predatory_lending_indicators": <value>
}

Sample queries

households.filter(h =>
  h.fraud.scenario_type !== null
).reduce((acc, h) => {
  const type = h.fraud.scenario_type;
  if (!acc[type]) acc[type] = [];
  acc[type].push(h);
  return acc;
}, {})

households.filter(h => {
  const cognitive = h.members.some(m =>
    m.cognitive_status !== 'none');
  const recentPoaChange = h.legal.poa_history?.some(p =>
    monthsSince(p.update_date) < 6);
  const recentBeneficiaryChange = h.estate.beneficiaries_by_account
    .some(b => monthsSince(b.last_updated) < 6);
  return cognitive &&
    (recentPoaChange || recentBeneficiaryChange);
})

households.filter(h =>
  h.compliance.aml_flags.some(f =>
    ['structuring', 'velocity_anomaly',
     'geographic_anomaly'].includes(f)
  )
)

households.filter(h =>
  h.fraud.account_takeover_flags
).map(h => ({
  id: h.id,
  attack_pattern: h.fraud.ato_pattern,
  authentication_anomalies: h.fraud.auth_anomalies,
  behavioral_changes: h.fraud.post_compromise_behavior
}))

Methodology

Each household's fraud-scenario assignment is generated against archetype-specific risk patterns. Medical-debt-crisis households (S-03) carry insurance-claim disputes calibrated against actual NAIC dispute typologies. Low-income working families (U-02) carry predatory-lending exposures calibrated against CFPB enforcement actions and AML-relevant patterns calibrated against FinCEN advisories. Neurodiverse / disability households (X-04) carry elder-abuse precursor markers calibrated against FINRA and SEC supervisory guidance. Account-takeover scenarios use realistic attack-pattern signatures derived from published cybersecurity research (Verizon DBIR, IBM Threat Intelligence). The scenarios are deliberately concentrated for adversarial utility — the 50-household corpus is roughly equivalent in adversarial-coverage value to a 1000-household corpus with realistic base rates, since the rare events are upweighted. The corpus passes the WealthSynth consistency validator (fraud-scenario labels are structurally consistent with the underlying household data; AML flags fire when the underlying transaction patterns match the typology) and the LLM-as-judge gate. Annual refresh tracks FinCEN, FINRA, NAIC, and CFPB guidance updates.

Included Archetypes (3)

Frequently asked questions