Purpose
Scan the details of a submitted claim, flag the specific fraud risk signals present, surface internal inconsistencies, and return a scored risk level with a clear decision recommendation — so specialists can triage claims quickly and route only genuinely suspicious ones to full investigation.
When to Use
Invoke this skill when the user asks to:
- Screen an incoming claim for fraud risk before approval
- Investigate a claim that "feels off" but needs a structured breakdown
- Explain why a specific claim was flagged or scored a certain way
- Triage a batch of refund, warranty, or insurance claims by risk
- Build a repeatable checklist for reviewing marketplace or platform disputes
- Decide whether to approve, request more evidence, or escalate a claim
Inputs Required
Before starting, collect:
- Claim type: Refund / chargeback / insurance / warranty / marketplace dispute / other
- Claim narrative: The claimant's stated account of what happened
- Claim amount and item/service: Dollar value and what is being claimed
- Claimant history: Account age, prior claims, prior refunds, prior disputes (if available)
- Timeline: Key dates — purchase/policy date, incident date, claim submission date
- Supporting evidence provided: Receipts, photos, police reports, tracking, communications
- Known account/transaction data: Payment method, shipping address, IP/location, device signals (if available)
If claimant history or account data is unavailable, proceed with the narrative and evidence, and explicitly note which signal categories could not be assessed.
Instructions
Step 1: Establish the Baseline Claim Profile
Summarize the claim in 2–3 lines: type, amount, item/service, and the core assertion. Note the value tier:
- Low (below routine review threshold): light scrutiny unless clustering is detected
- Medium: standard screening
- High (large payout or high-margin item): full screening even with clean signals
This calibrates how aggressively to weigh soft signals.
Step 2: Scan Fraud Signals Across 6 Categories
Assess each category. For every signal present, record the specific evidence from the claim — not a generic label.
Category 1 — Timing & Velocity Signals
- Claim filed unusually soon after purchase, policy start, or account creation
- Incident date suspiciously close to a coverage start or benefit-eligibility date
- Multiple claims in a short window from the same account
- Claim submitted immediately before a return/coverage window closes
- Gaps or precision anomalies in the timeline (round numbers, "just remembered" dates)
Category 2 — Narrative Inconsistency Signals
- Details that contradict each other across the narrative or evidence
- Story that shifts between submission and follow-up
- Over-detailed or scripted-sounding account (rehearsed language, unnecessary justification)
- Vagueness on details a genuine claimant would know (serial numbers, exact circumstances)
- Narrative that doesn't match the physical evidence (damage type vs. described cause)
Category 3 — Evidence & Documentation Signals
- Missing evidence a legitimate claim would typically have
- Documents with signs of alteration (mismatched fonts, inconsistent dates, edited images)
- Reused or stock imagery, or photos with mismatched metadata/context
- Receipts or invoices that don't match the claimed item, amount, or seller
- Refusal or delay in providing standard verification (police report, proof of ownership)
Category 4 — Identity & Account Signals
- Mismatch between billing name, shipping address, and claimant identity
- New or recently reactivated account making a high-value claim
- Payment method or shipping address linked to prior fraud or chargebacks
- IP/location or device inconsistent with the claimant's stated location
- Multiple accounts sharing identifiers (address, device, payment method)
Category 5 — Behavioral & Pattern Signals
- Claimant history shows a pattern of refunds, disputes, or "item not received" claims
- Claim matches a known fraud typology (friendly fraud, staged loss, inflated value, phantom purchase)
- Pressure or urgency tactics ("I need this resolved today," threats to escalate publicly)
- Attempts to steer resolution to a channel that avoids verification
- Similar claims recently seen across other accounts (organized/ring behavior)
Category 6 — Financial & Value Signals
- Claimed value inflated above the item's actual or market price
- Claim amount sits just under a review or auto-approval threshold
- Requested refund method differs from original payment (cash-out preference)
- Value inconsistent with the account's typical transaction size
Step 3: Cross-Check for Internal Inconsistencies
List every direct contradiction found — dates that don't line up, amounts that don't match evidence, narrative claims contradicted by data. These are the strongest indicators and must be called out explicitly and separately from soft signals.
Step 4: Score the Risk Level
Weight the flagged signals and assign one level:
- Low (0–29): No or only weak soft signals; evidence consistent — recommend approve.
- Medium (30–59): Several soft signals or one moderate inconsistency — recommend request additional verification.
- High (60–84): Multiple corroborating signals or a hard inconsistency — recommend hold and investigate.
- Critical (85–100): Confirmed contradiction plus pattern/identity signals, or match to a known fraud ring — recommend escalate and deny pending investigation.
Weighting rules: hard inconsistencies (Step 3) and confirmed identity/pattern matches carry the most weight; isolated soft signals carry little on their own but compound when clustered. State the top 3 signals driving the score.
Step 5: Recommend Verification Actions
List 3–6 specific next steps that would confirm or clear the claim — ordered by how much risk each one resolves (e.g., request proof of ownership with serial number, verify shipping/delivery scan, request unaltered original photos, cross-reference account identifiers, request police report number for verification).
Step 6: Deliver the Decision Recommendation
State one clear recommendation — Approve, Request verification, Hold and investigate, or Escalate/deny pending investigation — with a 1–2 sentence rationale tied to the score. Do not hedge.
Output Format
- Structure: Claim profile summary → flagged signals grouped by the 6 categories → inconsistency list → risk score with drivers → verification actions → decision recommendation
- Length: 600–900 words
- Format: Structured document — short summary prose, then bulleted signal lists and a scored verdict block
- Sections: Claim Profile → Flagged Signals (by category) → Internal Inconsistencies → Risk Score & Level → Recommended Verification Actions → Decision Recommendation
- Tone: Analytical and neutral — evidence-first, no accusatory language, no assumption of guilt
Quality Checklist
Before delivering output, verify:
- [ ] Every flagged signal cites the specific detail from the claim, not a generic category name
- [ ] All 6 signal categories are addressed, with unassessable categories explicitly noted
- [ ] Internal inconsistencies are listed separately from soft signals
- [ ] A numeric score and one of the four defined risk levels are assigned
- [ ] The top 3 score-driving signals are named
- [ ] A single, unhedged decision recommendation is given with rationale
Notes
- A genuine claim can trip individual soft signals — never flag on a single isolated signal alone; risk lives in clustering and hard contradictions.
- Friendly fraud (legitimate purchase, false "not received" or "not as described") is the most common typology on platforms and marketplaces — weight delivery/tracking evidence heavily.
- Keep language neutral and defensible: outputs may be reviewed by the claimant, compliance, or legal, so describe signals as observations, not conclusions of guilt.
- This skill triages and recommends; it does not adjudicate. High and Critical outcomes should route to a human investigator before any denial.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills