We encounter both legitimate and fraudulent break (B&E) incidents. Therefore, one needs to investigate these instances to confirm the kind of B&E case in each claim.

Reasons for B&E claims

During B&E investigations, alarm systems and CCTV video footage can be used to extract information. These could provide information regarding the timing of an incident, at the very least. They might show general business operation trends, how the property is typically protected when vacant, or who typically has access to the premises.

More sophisticated CCTV equipment can be tied to a point-of-sale (POS) system. These are better known as video and transaction matching. Systems this sophisticated allow point-of-sales transactions to be automatically matched with surveillance video. Essentially, the surveillance video image is a bookmark of the time when an event or a transaction occurred. This could be an additional avenue in adjusting claims.

These advancements in technology have significantly improved the investigative process. For example, an alarm system and video images could provide information about who, how, and when someone entered a building. An alarm system could also provide information that may confirm coverage under a policy. Both systems could corroborate that an incident did take place.

POS systems

Figure 1: A screenshot of a POS system matched to the video equipment.

Figure 1 shows a cash register of a fast-food outlet. This system tells you what was purchased and how it was paid for. It provides a wealth of knowledge that is beyond invaluable during investigations.

Where to find video evidence

We can obtain information from video equipment installed on the property and outside a building. Information can also be obtained from cameras installed next door if the neighboring building has video equipment outside. Doorbell cameras across the road from the property can also help greatly.

Dash cams usually operate when a car is in motion. However, some will continue to record while the vehicle is parked. Therefore, you could get vital information if you asked a neighbor about their dash cams. In addition, social media outlets such as YouTube and Instagram could also be a wealth of knowledge.

General red flags relating to alarm systems and video systems

1. An alarm or CCTV system is tampered with

Communication lines can be cut outside or inside the building. These phone lines are used for the alarm system to communicate with a remote monitoring station. Therefore, investigating these could help determine if the landlines were tampered with.

Cell services utilized by alarm systems can also be blocked with a jamming device. These devices are cheap and readily available for purchase. As such, spending time to investigate this possibility may help deal with the client.

2. Motion detector or camera operation hindered by unusual placement of contents

Placing or piling contents against motion detectors can indicate foul play because it renders the devices ineffective. In these cases, the insured may place a floor-to-ceiling product in front of a motion detector to hinder its operation. But, again, this can be done before the incident happens.

3. Door contact hardware was repeatedly defective

Defective hardware in the property entrances enables intruders or the insured to open the door without triggering an alarm system.

4. By-passing of specific alarm zones

People familiar with a property can bypass zones so that their presence in these areas is indetectable by an alarm system. Even when the alarm system is armed, it won’t be triggered in these scenarios. You need to investigate that because telltale signs can be found to suggest that zones have been bypassed moments or days before an incident.

5. Smash and grab

This refers to the suggestion of someone breaking into the property, rushing to the location of an alarm to smash the alarm panel off the wall, and defeating its operation before the entry delay sequence of the alarm system has elapsed. This prevents the alarm panel from communicating with a monitoring station.

Questions to ask in smash and grab scenarios

How is the location of the alarm panel known to the perpetrator?

These possibilities can only be confirmed if time is taken to investigate the alarm system following the incident, assuming that the perpetrators left behind the alarm panel.

6. The alarm panel is removed

Occasionally, the alarm panel is removed from the building during the break. Therefore, an adjuster must consider the potential reasons for removing the alarm panel. The same goes for removing a digital video recorder or a network video recorder during the break-in. One must question if the removal of this equipment is meant to hide the perpetrator’s identity and investigate accordingly. In addition, some alarm systems have varying time delay entries. For instance, it may take 30 seconds for an alarm to go off after admission or longer. Perpetrators familiar with the property often remove the alarm panel within this time delay.

Questions to ask
7. Weaving a story

The suggestion of an alarm system and CCTV system not working during the incident is another red flag. For example, an alarm company may get phone calls about the alarm system not working on the days leading up to a B&E. This could either be a setup or a genuine concern from the owner. However, a further investigation is required because it may allow for subrogation potential against the alarm company to be assessed. A detailed study also helps the adjustor determine if they can confirm coverage on the policy relating to the alarm warranty.

The same trend can be seen with security cameras. They are reported as malfunctioning and then get turned off. The homeowner may sometimes suggest that the digital video recorder was not operational. Others might claim that they don’t use their video equipment to record. Instead, they only use it to watch the screen. This is always odd and calls for further research during investigations.

Case study 1: Personal lines – fire incident

Figure 2: A large house that experienced a fire.

A fire was discovered at approximately 02:00 pm on August 27, 2009. The family had left for Niagara Falls at 11:30 am. The son-in-law stayed with them at the house but left the property at 10:45 am on the same day.

The house was reportedly locked and secured. An alarm system was installed but was not running or set. There was video equipment installed, but they claimed it was not functional. The DVR was thought to have not yet been set up by the installation company.

The son-in-law claimed he would use the cameras to watch the front door from his TV when the doorbell rang. During a discussion with the son-in-law, he indicated that he had issues with some people in the past. However, there was no telling if he was weaving a story. Therefore, we obtained authorization to enter the scene and investigate.

Figure 3: A photograph of the front door.

The stairs in the front hallway leading up to the second level showed evidence of substantial fire damage.

Figure 4: A close-up of the front door.

As shown in figure 4, there was also some physical evidence of the door having been kicked in.

Figure 5: A photograph of a portion of the house.

We brought in our canine unit and had two dogs search the home. We searched all three levels of the house and found several areas of origin. Our dogs both hit on several places in the basement, the main level, and the upper level. Fire debris samples were collected and sent to a lab for chemical analysis. The samples showed evidence of the presence of gasoline. There was also evidence of forced entry.

Based on the fire investigation, it was quite evident that this was an incendiary fire. More fire debris was found in the basement, more so than in other levels of the home. In addition, a DVR digital video recorder was also partially submerged in water. This DVR was connected to several cameras. Despite the owner’s claim that it was not operational, we decided to secure the DVR and investigate further.

Interestingly, police authorities and the Ontario Fire Marshal’s Office conducted the investigation ahead of our attending the site. However, as they were told that the DVR was not functional, they did not secure it as evidence, giving us the potential to obtain some interesting information on the video images.

Figure 6: A screenshot obtained from the video.

One of the videos we obtained from the DVR showed someone coming in and out of the house. The person was trying to kick out the door. He picked up a brick and tried to smack the door. Eventually, he fell right into the house. This person created the conditions to show that the front door was forced open. The video showed that the person lit a piece of paper and threw it into the front door.

Figure 7: Another screenshot from the video shows the fire department’s arrival.

As the fire department arrived, smoke came out of the house’s front door in the DVR footage. We discovered that the individual breaking into the house and setting the fire in the video images was the son-in-law. We reported this information to the police, who then secured the video images from us. They used these images to charge the individual with arson.

Case study 2: Commercial lines – B&E incident

Figure 8: The commercial property.

This incident was reported to the insurance company as a B&E with items vandalized and products removed or stolen. The insured said he left the building at the end of the workday on February 16, 2018. He was alone and did not arm the alarm system before leaving the premises. He claimed that he often did not arm the alarm system when he expected an employee to come in after hours. All employees and cleaners had their alarm code, so we could tell who disarmed or armed the alarm system.

Cleaners arrived at the building on February 18 and discovered the business had been robbed and vandalized. The owner suggested that the rear door would occasionally not engage or latch shut to the panic bar. Further, he said a gap at the top of the door could allow someone to pry it open. It was, therefore, upon us to determine if this information was being set up to justify that a break-in, whether legitimate or not, had occurred.

Figure 9: The inside surface of the door latched onto the panic bar.

Contrary to the owner’s statement, the door had contact with the panic bar and did not indicate a malfunction. The door formed part of the alarm system.

Figure 10: The alarm system.

All doors were contacted. There were motion detectors within the building and in various areas, including both offices, the warehouse, and the storage and workshop areas. Part of the investigation involved confirming if the door could be open from the outside, given that the panic bar reportedly did not latch properly.

Figure 11: Scuff marks observed on the door.

We looked for pry marks that might indicate that someone had gained entry into the building. We saw some scuff marks, but nothing that would suggest that someone pried the door open. So, there was no clear evidence of someone forcing their way into the building.

Figure 12: A photograph of some of the equipment installed within the commercial property.

There was graffiti on the equipment inside the building and evidence of the place either being burglarized or products being removed from the building. This turned out to be a red flag, mainly because the alarm system was not armed on the day of the incident.

When we interviewed some of the employees, we discovered that the owner always armed the alarm system when they left with him at the end of the business day, which was daily. They always saw him arm the alarm system, but he didn’t that day. Cleaners also confirmed that the alarm system was typically armed when they arrived to conduct their cleaning duties.

The alarm investigation

To corroborate or dispute the information relating to the activation of the alarm system, we reviewed and analyzed its information. In addition, we obtained a detailed report from the alarm company.

The three months of historical Alarm System Monitoring Station reports showed that the alarm system was always armed over a weekend. Getting a few months of records to show the trends and habits relating to the alarm system usage is essential. Unfortunately, alarm reports of the day of the incidents are often of little value to the investigation.

We also downloaded the event buffer from the alarm panel to corroborate information from the monitoring station report. An event buffer stores information relating to the activities of the alarm system. We accessed and analyzed data in the panel with the information transmitted in the monitoring station. This is especially important when there is an issue with communication lines and the cellular service being interrupted.

When phone lines are cut, or communications defected, one can usually rely on stored information within the event buffer. There are many instances where alarm systems are not programmed to transmit when they are armed or disarmed. So, you can rely on the event buffer to determine whether an alarm system was armed, when, or who armed the alarm system.

The event buffer will typically have more information than perhaps the monitoring station. However, one must rely on both sources of information. It’s equally critical to obtain this information promptly. Otherwise, you risk essential information being overwritten within the event buffer. Event buffers act as a first-in, first-out queue, meaning older information is deleted to make way for new data.

In this instance, we tested the alarm system to confirm that any entry through one of the exterior doors would result in alarm activation and an annunciation to the monitoring station. First, we armed the procedure several times and simulated entering the building. Next, we opened the exterior doors and walked through several areas where items appeared to be vandalized or removed to see how the alarm system would operate. We also checked if signals were transmitted to the monitoring station.

This test revealed that the system had been armed and would have functioned as intended. In other words, someone gaining access into the building through that door would have triggered a door contact and several motion detectors within the building. The incident only went unnoticed by the monitoring station because the alarm was not armed. Consideration at that point would be given regarding the coverage based on the fact that the alarm system was not armed at the time.

Lessons learned

The biggest lesson, in this case, was the importance of downloading the event buffer promptly. The alarm company can facilitate this by doing the manual download at the premise or through a remote online access feature. So, one should ensure that the alarm company cooperates and that one of their technicians attends the scene. If phone lines are still operational, an alarm company technician is not required at the location; they can retrieve the information directly from the buffer.

If the alarm company is not cooperating, the alarm panel must be powered down to avoid losing vital information from the event buffer. When the alarm panel is powered down, data in the system will not be overwritten.

The same goes for security cameras, digital video recorders, and network video recorders. Video images can be overwritten in time. So, acting quickly will preserve substantial evidence and information.

Catastrophic global events often lead to an increase in cases of fraud. This was evidenced in the 2008 recession, during which we statistically saw a significant rise in arson claims. We have seen the same trend since March 2020. However, we don’t look at every claim we investigate as potentially fraudulent because we’re in a recession.

A forensic expert needs to look at the physical evidence with no bias or preconceptions. Then, we must translate what this physical evidence expresses into a thorough report. This helps clients apply that information to their policy, whether to determine coverage, subrogation possibilities, or liability.

Background and discovery information

Every investigation starts with a collection of witness statements from the fire department and police reports. Discovery information also includes servicing history, history of the vehicle, and the vehicle’s performance before the fire. We ask for the vehicle accident history from the insured or through a CARFAX.

Photos are also invaluable during investigations. We ask for any pictures taken just before, during, and after the fire. It’s important to know what the reported condition and use of the vehicle were before the fire.

Before examining a vehicle, forensic experts also search for recalls, technical service bulletins, and blogs related to the vehicle’s year, make, and model. At times, an investigation will require the determination of the wind effects. In those cases, the vehicle orientation and fire time are crucial information. We will also want to know if the scene is still available for some fires.

Documenting vehicle fire scenes

The first step to documenting these scenes is confirming the VIN. If a VIN can’t be verified, a forensic expert will apply the same principles as structure fires. This means beginning the vehicle examination from the outside and working your way toward the most significant damage area. It’s crucial to note that the area of greatest damage isn’t always the area of origin; it could result from ventilation or fuel load.

If possible, the vehicle examination should take place at the fire scene. However, there is often a better possibility of origin and cause determination when examining a vehicle where the fire has happened for two reasons:

1. Surrounding fire patterns around the vehicle will show the wind effects and the surrounding fuel loads.
2. Evidence that has fallen from the vehicle can be retained. When a car is moved, evidence can be lost in the debris.

It’s often impossible to examine a vehicle at the fire scene because it has to be towed away if it’s being driven at the time. The process of documenting vehicle fire scenes stays the same no matter the circumstances. The more faithful we are to this process, the more vivid the evidence of fraud becomes, and the stronger the technical opinion of a forensic expert.

Total burns and stolen and recovered vehicles

When a vehicle has been burnt to a crisp (total burn) and stolen and recovered, crucial physical evidence is hard to analyze. However, several factors and techniques can significantly improve the evidence analysis.

Depending on the age of the vehicle, a locksmith can assist with door locks and ignition cylinders to see if a key was used. In addition, they often have access to the manufacturer’s specs and aftermarket security installations.

Depending on the extent of damage, the infotainment module may be downloaded and compared to the reported discovery and background information. Moreover, we can determine the pre-fire condition of the engine and transmission by analyzing the fluids. Fire debris for flammable liquids needs to be collected soon after the fire because it can evaporate. Therefore, it’s best to manage it within days because it increases the chances of getting an accurate test result.

It’s crucial to remember that fire suppression water will dilute and flush away the accelerant. As a result, it can destroy and throw evidence 50 to 100 feet away from a vehicle.

When investigating a fire, the origin must be determined through various means before thinking about possible causes.

Personal line case study 1

Figure 1: The vehicle’s dash area

The reported information was that smoke was discovered coming from the dash area. The driver exited the vehicle and called 911.

Working from the areas of least damage to those of most damage, we discovered some surface scorching to the dash. But there was much more damage below the area left of the passenger footwell.

Figure 2: A photo taken from the driver’s side footwell.

Figure 2 shows a similar amount of fire damage low in the dash. Again, this is similar to what was observed in figure 1.

Figure 3: An image of the passenger footwell.

During the examination, we saw melted plastic in the passenger footwell. The remains of the HVAC fan and its blades were also found in this area. The fan blades had fallen from their installation site. However, the dash above the area observed not much fire damage. None of the wiring harnesses or other components showed a high degree of fire damage.

Figure 4: After melted plastic was removed, the center lower area of the dash.

After the melted plastic was removed, the center lower portion of the dash was examined. Wads of napkins were discovered in the area of fire origin, and there was no evidence of an accidental ignition source. The insured could not explain why there were wads of napkins in an inaccessible area of the enclosed dash unless panels and carpeting were moved out of the way.

Personal line case study 2

Figure 5

The reported information was that the vehicle was driven when the owner noticed smoke escaping the passenger side dash. He pulled the truck over, called 911, opened the front passenger door, went around, and moved away from the vehicle.

The fire patterns observed in the examination did not support a fire starting inside the dash. Instead, it seemed like a fire had burned in the footwell or on the seat and attacked the dash. In addition, the components inside the dash cavity were in good condition. Therefore, if a fire started inside the dash, these items would be damaged and consumed before the fire even spread to other parts of the vehicle.

Figure 6: The excavated footwell

The footwell was excavated, and a large amount of packed and folded cardboard was discovered in the area, along with aerosol cans.

Figure 7: The cardboard layers discovered during excavation.

Permission was provided to remove the infotainment system, which was in excellent condition.

Figure 8: The infotainment module.

The download of this module showed that the vehicle had been pulled over at this location for about 16 minutes, with the car running and the doors opening and closing before the fire, causing the data to stop being recorded.

Figure 9: The report obtained from the infotainment system.

The driver had reported that he smelled, then saw smoke escaping the dash, pulled over, and called 911 at 1:38 pm. The bottom axis in the report shows the time and date, and the left axis shows the vehicle’s speed. There was no documented traveling of the car after 01:20 pm on the infotainment download.

The vehicle stopped moving at about 01:16 pm that day. The fire department report showed they were on the scene at 02:05 pm. The infotainment download showed that the vehicle was pulled over at 01:16 pm, and the truck didn’t move after that time. The only activity was doors opening and closing.

Commercial case study 1

A commercial vehicle was being driven when the driver reported some warning lights and smoke entering the cab from the dash area.

Figure 10: The engine compartment of the vehicle.

The reported information was that the vehicle’s owner was pulled over on the side of the road. When a passing tow truck pulled over, the driver jumped out, grabbed his fire extinguisher then quickly and efficiently extinguished the fire.

Upon arrival at the scene, we noted that the origin was small and located in the engine compartment beside or inside the fuse block.

Figure 11: The exterior of the fuse panel.

Some surface deformation and scorching to the exterior of the fuse panel were observed. However, this distortion to the material and the effects of heat were only present on the external surfaces. The areas adjacent to the affected location were utterly unaffected by the fire, indicating a very targeted application of flame on the surface.

Figure 12: The wiring harnesses in the fuse block, with insulation.

We examined and thoroughly documented the fuse block’s plastic body and the area’s wiring harnesses. First, we examined the wiring harnesses and began with the exterior protective cover (the loom). The loom protects the wiring harnesses located inside the fuse block. Next, the exterior and interior surfaces were examined after the removal of all sections of the loom. This allowed us to examine the wiring and insulation inside and on each of the conductors inside the harnesses.

Figure 13: The internal wiring.

Once all the charred material and loom were removed, there was no evidence that any of the wirings had failed. Inside each strand in figure 12 is copper wiring, where the current flows. In addition, each conductor has a sleeve of insulation. In this case, only surface charring of the loom and some minor heat damage to the insulation in some of the individual conductors were present. Therefore, we concluded that the only good ignition source for this fire was the direct application of flame.

Commercial case study 2

Figure 14: An image of the top surface of the hood.

A truck was parked in the operator’s driveway when he got alerted to the fire by a neighbor in the middle of the night. The truck hadn’t been driven in a few hours, eliminating the possibility of hot surface ignition as an accidental fire cause. The only other options were electrical or intentional ignition.

To determine the fire’s origin, we compared the fire damage and corrosion effects on the interior and exterior surfaces of the hood, the right fender, and the bulkhead at the base of the windshield. The top surface of the hood had orange corrosion occurring.

Figure 15: The underside of the hood.

The underside of the hood had minimal corrosion effects at the back-end edge, close to the base of the windshield. However, the underside did not show the extent of corrosion observed on the top surface of the hood. This indicated that the fire possibly originated on the vehicle’s exterior and not inside the engine compartment. This was the first clue that the fire may have been intentionally set.

Figure 16: The area of fire damage.

The fire damage in the right rear quadrant of the engine compartment had a considerable amount of electrical wiring that needed to be examined for evidence of electrical failures. An energized wire could provide proof of an arcing loss resulting from the fire spread. In this case, there were no electrical failures in the general area of fire damage.

The fire burned intensely on the vehicle’s exterior surfaces from an accelerant being poured. In contrast, there was less fire damage and loss of material inside the engine compartment.

Figure 17: The passenger fender.

The passenger fender showed the effects of an accelerant burning on the exterior surface. However, the side of the fender facing the tire and the engine compartment had less loss of material in comparison.

These case studies indicate that physical evidence is the most critical aspect of vehicle fire investigations. As a forensic expert, you don’t have to factor in the insured’s intent because it is outside the scope of your inquiry. However, legal experts must carefully determine the purpose where necessary.

The arson triangle

Typically, people steal vehicles to drive or tear them out for parts. So, a car with significant fire damage is a major cause for concern. Vehicle fires, as a result, always warrant an extensive investigation that considers these three points:

1. Proof of a deliberately set fire
2. Motive
3. Opportunity

We rely on forensic experts to show that there’s an incendiary fire. Motive, the second part of this triangle, is inevitably financial. The financial reason is often demonstrated in documents or other investigations. The third part of the arson triangle answers the question of who had the last or best chance to be on the fire scene. Cell phones and video surveillance have made it easier to determine when people were at the scene, which often turns out to be a vital part of the analysis.

Statutory condition 6 is your friend

Statutory condition 6 allows an insurer to submit an examination under oath. You can have you’re insured examined to produce reasonable evidence. Using this statutory condition, an insurer can obtain financial or maintenance records, amongst others. Obtaining bank records or a credit card history of the insured, for example, could help determine the motive. Vehicle records could also help determine the reason for arson.

Case study

Figure 18: The burnt vehicle.

The insured reported a vehicle stolen from the driveway during the night and was found burned the next day. The fact that the car was found burned was a cause for suspicion. In this case, investigators determined that an accelerant was used to start the fire in the vehicle’s backseat. This determination met the first requirement of the arson triangle – confirmation of an incendiary fire.

Statutory condition 6 was used to get an undertaking to obtain maintenance and bank records. The maintenance records showed that the vehicle was in the shop every other month for fairly serious repairs, and the insurance still owed money on the purchase. In addition, the vehicle needed a new transmission at the time of the incident, and the estimated cost was approximately $4,000. So, a significant payment was on the horizon if the owner wanted to keep the vehicle.

The bank records showed that the insured was in a financially precarious position. He was overdrawn on his bank account and had credit card debt. So, there was a financial motive as well.

The vehicle was in the insured’s driveway, and the owner had the only set of keys at the time. When looking at a vehicle fire, you always want to start with the keys for the opportunity element – who had the keys or access to the keys?

All the elements of fraud were present in this case, and the claim was denied. However, the insured continued with the claim. Our experts continued their investigation because it appeared that the case could go to court. In addition, the investigators spoke with the ex-girlfriend of the insured, and she knew of the entire plot to burn the vehicle. She gave us a signed statement where she detailed what occurred.

The insured returned with his ex a few months later and tried to resurrect the claim, but we already had the signed statement.

This example underscores the importance of detective work. You must ensure that you’re turning over every rock during the investigation and doing so fairly and comprehensively. People who commit these crimes also tend to talk to their loved ones. And so, interviewing the right person is a big help. Social media dramatically assists you; you can find the insured’s close friends.

Key takeaways
Contact Origin and Cause for Vehicle Fraud Investigation Today!

The cause of a mechanical loss can be as simple as a piece of equipment or a more complex system. In other cases, a mechanical loss could be due to an entire assembly line. For example, we often encounter complex mechanical claims if an item has moving parts. In such cases, the object would have different components that could be utilized to move those parts smoothly and without friction. Instead, however, those parts can fail.

Mechanical systems are sometimes intertwined with electrical systems, which would make these systems electrically energized. Mechanical claims are not only based on cars, but vehicle claims are amongst the most common. Vehicles have intricate and detailed designs, making their claims more complex.

The first step of every fire investigation is determining the area of origin. Without this step, it is impossible to investigate the cause of a fire. When determining the area of origin, we consider fuel loads, wind speed, and wind direction (if the loss occurred outside).

It is also essential to collect background information, discovery, and service history. Technological advancements have made the information-gathering process much more manageable. We now have computer systems that provide some of this information. For example, we can find wiring and routing diagrams of different vehicle wiring harnesses without going to the dealer.

In-vehicle fires, a flammable liquid that has escaped from its position can form a vapor cloud, which a hot surface can ignite. In addition, there are hot surfaces in the engine compartment that run from the front to the rear of the vehicle, meaning there are several opportunities for ignition.

A complex mechanical claim always starts with a preliminary investigation. This involves a site visit to determine the extent of the damage, the level of complexity, parties involved, and specialists you may need to retain. A preliminary examination allows one to examine and preserve the physical evidence and determine if it needs to be moved. However, it is highly unethical to conduct an on-site examination without all the involved parties present.

Gathering background information

Mechanical systems are often three-dimensional, making it challenging to document all physical evidence at the beginning of the investigation. Therefore, one of the first analysis steps is to request information from the client and gather witness statements. This makes it easier to collect discovery information at the earlier stages. In addition, fire department and police reports are often precious sources of information.

It’s also crucial to request documentation for recent service work on the vehicle or equipment. For example, determining if the car was stationary or moving at the time of failure could indicate potential failure modes. It is equally crucial to get information on the vehicle’s performance before the fire. A recent service report involving the electrical system further allows investigators to identify parties to examine the scene or evidence.

Always ask for the Vehicle Identification Number (VIN) to access recalls and published recalls through Transport Canada or NHTSA. You can also use Mitchell1 and AllData to access technical service or technical support bulletins. Additionally, an investigator must request a CarFax to access the vehicle’s accident history and servicing information. This could help determine the area of origin of the fire.

Potential ignition sources

Case study 1: Personal vehicle

A Dodge Ram EcoDiesel was recalled after discovering that the Exhaust Gas Recirculation (EGR) cooler suffered leaks from thermal fatigue. The cooler expands when heated and contracts as it cools down. At times, the thermal expansion of EGR coolers creates tiny cracks. However, EGR cooler fires only occur when the vehicle is in operation.

Figure 1: The vehicle that caught fire

The owner was driving the vehicle at approximately 100km/h when he heard a loud pop from the engine. When he pulled over, he saw nothing wrong. However, when the vehicle owner continued driving, he experienced a loss of power. Shortly after, he was alerted to the fire by someone in a nearby vehicle. It is impossible to see where fire ignites when looking at the engine because it occurs inside the intake manifold.

The engine compartment and the hood sustained minimal fire damage, and the hood was flipped up onto the windshield. The engine compartment had a distinct fire pattern underneath the intake manifold, which indicated that the fire originated inside this intake manifold.

Figure 2: The inside of the engine compartment (left) and the underside of the hood (right).

During a preliminary examination of such vehicles, one must document the systems to determine the cause of the fire. Then, the vehicle manufacturer and the dealer must be invited for the examination. Removing the EGR system, followed by a pressure test, is the only way to determine whether there is a failure or leak in the EGR cooler. In such cases, a destructive examination is necessary. This refers to the altering of evidence for an extensive investigation. During the joint destructive examination, we removed the entire EGR system.

Figure 3: The car’s EGR system.

The car exhaust flows through the EGR cooler with two downward-facing side ports. These ports are the inlet and outlet of the coolant. The EGR cooler takes coolant from the engine coolant system and routes it through the heat exchanger. So, the exhaust and coolant run through the EGR cooler, but separately.

During the failure of an EGR cooler, thermal fatigue causes the coolant to leak out of its controlled system into the exhaust flow, which then goes directly into the intake manifold. Usually, an EGR system blends some exhaust gas into the intake with fresh air to keep it within the target emission level.

Figure 4: A schematic of the EGR system.

Thermal fatigue cracks can occur in the heat exchanger, allowing coolant to enter the intake manifold. The EGR Transport Canada Recall states that “thermal fatigue may cause the cooler to crack internally over time. An EGR cooler with an internal crack will introduce pre-heated vaporized coolant to the EGR system while the engine is running. In certain circumstances, this mixture interacts with other hydrocarbons and air in the system, potentially resulting in combustion within the intake manifold. It can lead to a vehicle fire.”

Figure 5: Two hoses connected to pressurize the coolant running through the EGR cooler.

As indicated in figure 5, there is a pressure gauge at the end of one hose. Under the testing conditions determined by the manufacturers, we used a bicycle pump to get the pressure in the system to 20 psi. We then submerged the cooler into a pail of water. Submerging the cooler in water results in a stream of tiny bubbles if there is a leak. A more significant leak will result in much larger bubbles. Tiny bubbles were observed.

The manufacturer had a long delay in engineering and manufacturing the replacement parts for this EGR recall. You can acquire an EGR delete kit online and through parts suppliers. However, it is not an OEM option, so the vehicle manufacturer does not support an EGR delete kit. It removes the car system, increases the power in the vehicle, and increases emissions. If improperly installed or completed, it could even be a possible failure mode.

We discovered that an EGR delete was partially completed, and the exhaust was not completely connected. The vehicle owner drove with the exhaust coming out of the manifolds. He essentially had no exhaust system from that point towards the rear.

Critical takeaways for auto adjusters

Case study 2: Wheel-end fire

Figure 6: The truck that experienced a wheel end fire.

Wheel-end fires are common in mechanical claims. There are three different scenarios when a wheel-end catches fire. First, a truck typically has two wheels on one side on the same axle and two wheels on the other side. If one of those tires loses pressure while the trailer is being pulled down the road, it can create friction and result in a tire fire with nothing wrong with the brakes or the wheel bearing. In such cases, the tire itself can burst into flames.

Figure 7: A functioning wheel bearing (left) and a bearing indicating failure (right).

Wheel-end fires could also be caused by a failure in the brakes and bearings. However, if the cause of a wheel end fire is not the brakes or bearings, we can hypothesize it is a tire fire. In this case, the truck was pulling the trailer at the time of the fire. The driver saw smoke coming from the trailer. When he pulled over and got to the rear of the trailer, one wheel-end was burning.

Preliminary examinations of wheel-end fires often have limitations. You cannot remove the wheel-ends without the other involved parties present. During an initial examination, we can do things to help eliminate the brakes or bearings. However, a complete investigation is only possible after removing the wheel ends and in the presence of all involved parties.

In the functioning wheel bearing in figure 7, all the roller bearings are spaced perfectly around the perimeter. The other bearing shows two different sets of rollers. On the right-hand side, the roller bearings look damaged. They have essentially been smeared due to elevated temperatures. The cracking and gouge marks on the right-hand side in figure 8 indicate a brake drag resulting in excess heat.

Figure 8: Fire-damaged brake pads with no cracking or excess heat damage (left) and brake pads with visible cracking and gouge marks (right).

The brakes automatically engage if you lose air pressure to a vehicle system such as a tractor-trailer system. The air pressure pulls the brake pads away from the inside of the drum. It is a noticeable change to the vehicle driver because a brake system failure results in a significant drag. The scoring and cracking inside the brake drum in figure 9 indicates a brake drag that resulted in extremely high temperatures. The friction from the brake drag subsequently causes fire.

Figure 9: Fire-damaged brake drum with no cracking or excess heat (left) and the inside of the brake drum with visible scoring and cracking (right).

Even in a wheel-end fire, a service record is necessary before an investigation can be concluded. Investigators also need to know when a wheel bearing was last changed, previous problems with tire pressures, and the mileage on the trailer.

Figure 10: A diagram showing a brake pad system.

As indicated in figure 10, the slack adjuster and push rod normally form a 90-degree angle. A typical preliminary examination includes measuring this angle to ensure that it is correctly oriented. This angle is measured at all the wheel-ends and in every axle. The measurement shows us if one wheel-end is significantly different from the others.

The slack adjuster will automatically adjust to keep even brake applications as pads wear, but they need to be appropriately set when they’re installed or when the wheels are removed. A brake system failure could also result from a manufacturing defect or improper servicing.

Figure 11: Images showing the measurement of the slack adjuster angle and the pushrod length.

We discovered that during the manufacturing process, there was a bracket. We determined that the bracket was installed upside down to secure the slack adjuster in position. Since it did not retain the slack adjuster, it did not operate properly. In this case, all the brackets in the trailer were installed incorrectly.

Figure 12: Images showing the improperly installed bracket.

Case study 3: Agricultural

A combine suffered a fire while it was operating. Smoke and then a fire was observed by the operator on the right-hand side of the combine. The operator shut the combine down but was unable to extinguish the fire. There was a tremendous amount of fire damage on one side of the combine (figure 13), and there were no reported operating issues leading up to the loss.

Figure 13: The fire-damaged combine.

Multiple ignition sources surrounded the combine. The fire was first spotted on the damaged side of the combine, near the elevator.

Figure 14: A close-up of the combine elevator.

The bearing for the straw chopper was identified as having a failure. A bearing failure can never result from the fire because the temperatures reached during a fire are not high enough to smear hardened steel. When we noticed that the alignment of the bearing was off, we requested a service history of the equipment.

In the absence of a service record, we would have to look at the recommended maintenance by the manufacturer to see if and how it was supposed to be serviced. We discovered that no servicing was required for the equipment.

Figure 15: A disassembled bearing for further analysis.

To get a clearer view of the areas of interest, we removed any obstructing items from the equipment. It allowed us to see that what remained of the bearing was smeared metal.

Some bearings are self-lubricated, while others need to be greased every 30 hours. Some equipment has an onboard fire suppression system, including a tank of suppressing agents piped to nozzles throughout the machine. Most often, this would be the engine compartment. Sometimes it will be where the hydraulics are, but that is rare.

The nozzles are always open so that if the suppression system is activated, the agent will be forced out of every nozzle. There are two methods of activation – manual and automated. Sometimes, there are temperature sensors in the engine compartment, and a manual activation sometimes is required. The switch for manual activation is usually in the cab.

Due to its several systems and parts, a combine loss can become an extremely complex fire investigation.

Figure 16: An example of the parts and systems of the combine.

Figure 17: A close-up of figure 16 indicates the part that failed with a red oval.

Figure 17 shows the bearing components for one beater bar. Part of the combine has a separator, and the separator hours are tracked on a combine. The total hours these components would be running are then documented. As such, we needed to examine the hours and greasing procedure compared to the manufacturer’s recommendations. We also had to consider the grease amount and the type of grease used.

Using the wrong grease might impact whether a bearing can withstand its expected lifespan and load conditions or if it would fail prematurely. Sometimes we must analyze the bearing side versus the load.

Case study 4: Mechanical damage

Figure 18: The safe

Nine years ago, we were retained to investigate and assess an alarm system after an alleged break-and-enter at home in Toronto. During an alarm system assessment, we discovered that the safe had been broken into. Over $100,000 worth of items were stolen from the safe. As such, the safe was examined.

Figure 19: The locking mechanism on the safe.

The safe was in the locked position while the family was gone, and no one that remained in Canada had the combination to the safe. However, no deformation was observed on the throw of the safe. The secure door was removed, and the safe body remained intact within the wall. The safe installation was between two wall joists. The safe was therefore removed for further examination.

Figure 20: The safe after removal from the wall.

As shown in figure 20, the upper holes on the safe body indicate that the split pin from the hinge assembly on the door sustained minimal damage. The bracket in the bottom image is where the throw from the locking mechanism would have come against, and it had minimal scraping damage, but there was no total deformation. The flange was located approximately an inch from the edge of the safe, and the door rested against it when closed. The door was recessed about an inch inside the safe body.

Figure 21: The front of the safe door.

Figure 21 shows the deformation on the hinge assembly, which indicated that it was pried away from the door at the top and bottom. The limited deformation on the body of the safe did not match the extensive deformation on the hinge assembly. Therefore, it made no sense for the safe to have been pried with the door closed.

Figure 22: A close-up of the hinge assembly showing scratches.

There was significant deformation to the edge and surface of the hinge assembly. This indicated that a pry bar was placed between those two parts to open the safe. However, the damage only lined up with the doors in an open position.

We concluded that this was an attempt by a colleague of the insured to pry the safe door. They tried to pry it open when it was closed, but they could not break into the safe. So, they opened the safe door using the combination and then pried the door off while in the open position to make it look like the safe had been broken into.

Key Takeaway:

Partner Up with OCI Group to Uncover Mechanical Loss Claims

Claims involving mechanical losses might be difficult to decipher and grasp. OCI Group’s team is well-equipped and knowledgeable in the field of complex claims, as well as how to perform an investigation to determine the root cause of a failure. We provide concrete responses based on facts, and all conclusions are reached only after the facts have been verified. To assist you with your claim, call OCI Group at 1-888-624-3473 today.