It can be challenging to differentiate between an incendiary fire and arson because the differences are subtle. Incendiary fire speaks to willfulness relating to the criminal ignition of property. Arson refers to the criminal act of deliberately setting fire to property or recklessly starting a fire or explosion. The incendiary is the causal factor, whereas arson is more related to the charge.

We look at whether the fire was deliberately ignited during incendiary fire investigations. We consider whether the person knew that the fire should not be ignited. This means such cases rely strongly on Mens Rea, meaning intent or knowledge of wrongdoing that constitutes part of a crime.

When investigating incendiary fires, a fire scene’s approach must be unbiased. We approach it with a systematic and methodical approach and a process of elimination. Therefore, we can only render our conclusion once we’ve gathered all facts relating to the case.

While knowing the motive may be an added advantage, it’s beyond the scope of an investigator. The motive is crucial only to the legal aspects of the investigation. These are amongst the most common motives in incendiary fire claims:

1. Financial
2. Revenge
3. Mental health
4. Mischief
5. Serial arsonists

Incendiary fire indicators

Indicators range from multiple fires, unusual fuel load or configuration, irregular fire patterns, burn injuries, lack of expected fuel load, and incendiary devices to lack of ignition sources. If a home is vacant, it may provide an opportunity for ignition. We may also look at the conditions of doors, windows, and the property if it appears abandoned.

During investigations, it’s also essential to look for disarmed alarm and sprinkler systems that may have been tampered with.

Multiple fire indicators

The site of a previous fire mustn’t be confused with a new one. For example, if a fire occurred in the home, and some of the damage was not fixed, the earlier site could be mistaken for the current one. Therefore, it is incumbent on the investigating team to obtain a fire history of the structure. Because fires that occurred at different times naturally won’t correlate, it’s crucial to get the fire history of the system from the Fire Department.

Irregular fire patterns

Figure 1: An example of an irregular fire pattern.

When at a scene, an investigator must look at irregular fire patterns. Look for anything that suggests that the fire came from other areas. It’s equally important to look for debris that indicates that there could have been an extension cord or anything else that could have been a competent and potential ignition source.

Combustible fuels or ignitable liquids are often used to spread the fire. These may leave distinctive patterns on horizontal surfaces. It’s vital to determine whether these patterns are not from other mechanisms such as electrical failures, smoking, candles, stovetops, spontaneous combustion, or lightning.

Materials that can be used in incendiary fires

While several other combustibles exist, these four remain the most common. In addition, some homeowners use toilet paper or pls as ignition materials for incendiary fires. However, it is not the materials that constitute a fire pattern but how they are used.

Figure 2: A bedroom where a fire occurred.

In figure 2, a protected area is surrounded by surface heat damage stains. There is another protected area on the bed. The secure area on the floor continues down the stairs. In this case, a suspect poured gasoline on the surface, and the fire died due to a lack of ventilation. When we look at irregular fire patterns such as these, we need to pay attention to the protected areas because they’ll often tell us what material was lying there.

Lack of expected fuel load

When visible damage isn’t consistent with the fuel load, it always warrants further investigation. In cases where a protected area is seen, the police may remove the material. The absence of the fuel itself is not enough to classify a fire as incendiary. Sometimes there is an area in a corridor, stairway, or hallway that does not have as much fuel load. But this area will have a burn pattern that needs to be investigated further to confirm that the cause of the fire is not spontaneous combustion, a lit cigarette, or another product that may have oxidized.

Some investigators habitually only look at the burn areas and neglect the debris. It’s essential to search the debris because you may find significant pieces of physical evidence for further analysis.

It’s equally critical to examine the burn area in totality. If you’ve collected enough physical evidence for samples, never leave part of the burn area unexamined. For example, going to scrape the floor in the area could reveal crucial pieces of evidence. Look in areas such as closets, crawl spaces, and attics.

Unusual fuel load or configuration

An arsonist may move furniture and combustibles closer to speed up the fire spread. However, this makes it easier to see that there are no other potential and competent ignition sources for the area. This indicator helps us build our facts during investigations. However, we must be careful not to assume that unusual fuel loads are related to a deliberately set fire. For example, people may have had a party before the fire, resulting in a need for a reconfiguration of furniture. To rule this out, investigators look for potential ignition sources in the area.

Before going into any scenes, one must get as much information as possible from the insured. When taking a statement from the insured, ask them to write where the furniture is or where it should be on a piece of paper. In addition, you may wish to have them indicate if there are any extension cords or other possible electrical ignition sources. This process of elimination can lead to a more efficient fact-finding mission.

When collecting the insured’s statement, information about the furniture materials and the fuel type must also be obtained.

Burn injuries

People that are involved in setting fires can often get injured. Those injuries require analysis to ensure that they are consistent with the fire. For instance, if the exposure to heat is through radiation, chemical, or electrical burns, the injuries should match the insured’s statement.

In the process of elimination, you must attempt to determine the type of burn injury. For example, the extent and type of burn injury sustained from boiling liquids or cooking may differ considerably from one incurred in a drug lab. These are crucial considerations when analyzing body injuries.

If there are bodily injuries and somebody is trying to delay the fire, you’ll probably have incendiary devices.

Incendiary devices

When incendiary devices are seized, it’s vital to ensure proper continuity and analysis. Part of the investigation and analysis process is also ensuring that all vested parties are invited to attend.

There’s a wide range of mechanisms for incendiary devices, and almost any appliance or heat-producing device can be used. These devices include candles, oil lamps, Molotov cocktails, matches, cigarettes, and stovetops.

Remains of incendiary devices can often be found on the scene, making it easy to send them for lab examination. They can also be found in the debris. Upon obtaining the remains of incendiary devices, they must be properly bagged and sealed.

Some incendiary devices are constructed as delay devices to allow the fire setter time to leave the scene. If an explosive device is found in the background, it must not be removed or touched, as it may have a timer. Not touching the device also avoids contamination or spoliation. Spoliation can also be prevented through security.

The presence of incendiary devices does not always mean foul play. For example, the presence of ignitable liquids may be normal in a typical residential garage.

Methodology and Considerations

The two aspects of investigative processes remain the same in commercial and residential claims. Therefore, we look at fire scenes with no preconceived notions to ensure that we provide an unbiased report.

Sometimes, emergency services will be required at the scene, delaying the forensic investigator’s access. During these delays, the investigator must ask the contractor to secure the scene to ensure that it’s not contaminated and that the scene is well-documented. Consider all your hypotheses, the process of elimination, and the patterns offered.

Figure 3: A burnt rubber carpet with an irregular pattern.

Burn patterns are often the key to discovering the cause of a fire. Examining the pattern and its surroundings can provide much-needed physical evidence. In addition, this thorough examination could help confirm if other objects could have dropped in the area of origin.

Forced entry

Figure 4: An example of a forced entry indicator.

In a thorough process of elimination, you must also look at the possibility of forced entry. In the case shown in figure 4, screws were found on the floor, and the door had been replaced. At first glance, you would not tell that the garage door at the back had been removed.

Considerations

As an investigator, key questions and considerations in forced entry claims include:

Key takeaways

Case study: Commercial fire

Figure 5: The commercial building during the fire.

The building, in this case, operated as a pork and meat plant. It also had another tenant who ran a slaughterhouse for pigs and cattle. In addition, the plant was both CFIA and USDA approved.

Figure 6: The location of the first fire.

An employee discovered a fire outside a washroom in the basement at 3:50 am. The fire department attended and extinguished the small fire. They did not raise any concerns about how a fire could start in this location.

Figure 7: The location of the second fire.

After the extinguishment of the first fire, the fire department left. Staff was allowed to enter the building when within approximately 15 minutes, a second alarm was raised in a cooler room on the north side of the plant.

The fire department reattended, but the fire had taken hold as cork, and foam insulation was in the walls. The fire took at least 24 hours to get under control. It was subsequently determined that both fires were entirely separate and deliberately set.

Figure 8: The detached gas line.

During the investigation, a gas line was found disconnected in the boiler room, which was away from both areas of the fire.

Figure 9: The meat processing area after the fire.

All the stock was damaged, and the roof of the plant collapsed due to the second fire.

Figure 10: The roof after the fire.

Challenges at the scene

Unique Coverage issues

Three separate companies were named on the insurance policy, namely:

1. Landlord-owned buildings
2. Operating tenant
3. Tenant (the slaughterhouse)

The mortgage company sought payment under the Mortgage clause. In addition, the operating tenant was subsidized and placed in receivership. We also had a business interruption claim.

The tenant ultimately retained a public adjuster and filed for proof of loss for approximately $9.6 million. There was a claim for both building and equipment damage. Moreover, the receiver filed a lawsuit for $3.2 million that included various components, such as stock, tenant improvements, business interruption, ordinary payroll, and professional fees. The landlord’s lawyer later claimed for equipment and business interruption.

Lessons learned

1. Interview the insured at the first opportunity. The insured was interviewed on day one in this case. The three-hour interview secured some details on the loss. This turned out to be the only opportunity we got to speak to the insured. When the police designated the scene as a crime scene, they did not provide details on why they did that. The insured retained legal counsel, and we never got the opportunity to interview them or secure formal statements over the next eight years, which was the life of the fire.

After the first and only interview, we had no access to the insured as all the flow of information was through solicitors. So, if we hadn’t interviewed the insured early on, we would never have gotten any evidence from them. Adjustors and investigators also need to speak to people who were at the scene. We talked to a mortgage company representative who attended and obtained valuable documents, such as a pre-loss appraisal report and pre-loss photographs. We secured this with the insured’s permission. Had we waited, we would have never received this permission from the legal counsel involved.

2. Retain the good investigation team and counsel early on. It’s essential to have the right people in place. In this case, we retained security to protect the scene and keep a proper log of all persons entering and accessing the site while investigating. In addition, we had engineers identify the structural damage and define the type of building that existed before the fire. This information helped us price what it would cost to repair or rebuild.

We retained a roofing consultant to comment on prior deterioration and poor maintenance. We included an environmental expert in determining what hazards existed at the site. We also had an equipment expert tell us whether the equipment could be lubricated to avoid deterioration. Moreover, we retained a cleaning company and conducted various tests in the building to determine the best cleaning method. Then, we retained accountants to verify the inventory and stock.

3. Tread very lightly on suspected arson cases. Insurers face a lot of pressure from the insured and the authorities to pay for things that require repairs. You’ll have to resist this pressure while the investigation is ongoing.

It’s tough to explain to non-insurance people why the insurer doesn’t want to pay for the cost of emergency work acquired at the site. On day 3 of this case, the adjuster was told that the CFIA had condemned the meat in the building. They were subsequently exposed to return with a plan to remove around 500 carcasses that weighed 700 pounds from a structurally damaged building. After producing this plan, they brokered a deal between the insured and a rendering plant they had contacted, where the insured agreed to pay for removing the contaminated meats.

We then arranged for accountants to count meat before loading it onto trucks. However, as we had 10 trucks lined up outside the following day, the ensured said he wasn’t paying for it. Instead, the bank had appointed a receiver who froze the insured’s assets overnight.

It’s essential to remember that an insurance policy is a legal contract. So, you can use statutory conditions to your advantage. They can back you up when you are faced with a lot of pressure from the insured or the authorities to pay for emergency work that needs to be done. Use these conditions to explain why insurers cannot commit to coverage until the investigation is complete.

Examples of statutory conditions are number 6, which details requirements the insured needs to follow after a loss. Statutory condition 7 details that coverage is invalidated if there’s fraud and action by the insured or persons acting on their behalf.

Statutory condition 10 details the insurer’s rights to enter and control the site to conduct an investigation. Even so, we would usually still get written authorization from the insured to attend the site. That condition also states that insurers cannot abandon salvage. Statutory condition 11 deals with any disputes. So, if you get into a disagreement on quantum, you can use that condition to resolve the dispute.

History has shown that in times of economic hardship and high unemployment, instances of insurance fraud increase dramatically, and the current global recession is no exception. Our observations in the field and conversations with insurers support this narrative. In the past several months, we have seen an increasing number of suspicious claims that represent a growing problem for insurers, including fraudulent water claims.

Water losses aren’t always as straightforward as other types of losses. They come with several challenges, especially in determining the cause of failure. Unlike a fire loss, for example, the absence of the insured from their home does not necessarily make a water loss less likely.

Difficulties with water claims

They often occur passively – Because water supply systems are always pressurized, passive failures can occur anytime. An insured can return from a vacation to find their flex hose or some other fitting has failed. Therefore, the passive nature of the loss makes it harder to identify the intentional act.

The intentional act may occur before the loss – Intentional water losses are hardly ever hammer-to-the-pipe scenarios. Homeowners could create a weakness in the system to make the loss appear more realistic, leading to the pressurized system failing on its own. This is motivated by the fact that water damage does not destroy the evidence like arson does. This means intentional damage to a pipe, for example, won’t be washed away by the water.

To avoid detection, homeowners create a situation where the loss somewhat occurs on its own. For example, a homeowner could loosen a valve or the threads on a connection or turn off a thermostat. In such scenarios, it takes time for the pressure to force a valve or cap open and for the house to reach freezing temperatures that lead to a freezing burst.

Fraudulent claims look like real claims – All fraudulent water claims bear the same elements as accidental claims, in that water escapes through the exact mechanism in either case. And so, only an extensive and fairly detailed investigation can conclusively determine whether a water loss should be classified as intentional or accidental.

Coverage denial issues

As a solicitor, you must consider several factors when you receive a claim. These factors affect coverage and the direction you take when dealing with a lawsuit.

Beware of bad faith claims

Bad faith claims are always the primary concern in the insurance industry. As a result, the industry is constantly searching for ways to avoid these claims and deal with the insured in such cases. Therefore, due diligence requires that we determine whether coverage is appropriate and fair to the insured.

Whiten v. Pilot

The Whiten v. Pilot case is a relatively extreme example of what can happen if you leave your insured in the lurch. However, it is a good reminder that you can’t make decisions based on instinct during coverage claims. You can’t cut your insured off unnecessarily while you’re investigating the loss. Even if you suspect a loss is intentional, you still need to investigate further and deal with the insured almost neutrally while doing so. This means you may incur ALA costs during the investigation, despite suspicion of insurance fraud.

Complete neutrality means doing emergency mitigation. For example, you may need to send someone to dry up premises to prevent further loss. You won’t prejudice your insurance. If damage worsens during the investigation, you must deal with it if coverage is not denied.

Avoid complete mitigation work like removing the walls. Your retained engineer will need to see all the evidence to determine where the water flowed. Removing the drywall may eliminate some proof. Limit your efforts to emergency mitigation.

Look to policy language

The best thing to do is look at your specific policy conditions. Water losses are not subject to the same statutory conditions as fire losses. Many policies incorporate the statutory requirements for fire loss into other losses, but they’re not required to. So, you’ll have to look at the specific policy language to see whether those stack conditions apply. This will allow you to see what other exceptions or limitations may apply.

For example, suppose a water loss occurs in a seasonal home. In that case, a specific policy term may indicate what must be done to winterize that residence if it will be vacant for a certain period. This policy term may also state how long the owners can leave the place empty. Those are easier terms to utilize if you want to deny coverage over a loss. In addition, they’re explicit in the policy, meaning you don’t need to consider whether the failure was intentional or accidental. Instead, you can just look to something outside the bounds of policy as a basis to deny coverage.

Policy exceptions lie more in freeze-up losses. They predominantly stipulate the amount of heat required or how long you can leave the place vacant. Your policy may only cover specific types of water losses. The easiest way to deal with those claims is by looking at the particular policy language.

Denial of claims requires loss to be intentionally caused

If you’re going to deny a claim based on something other than explicit policy language, you must prove that the loss was intentionally caused by the insured. The general rule of first-party insurance is that it covers fortuitous losses only, meaning coverage does not depend on the failure being utterly free of the insured’s fault. Their negligence can still lead to coverage, but it must be unintentional. The onus is on the insurer to prove positively that the insured intentionally caused the loss, which can be tricky.

Investigation of water claims can suggest negligence as being just as likely of a cause as an intentional loss. A thermostat being off when homeowners leave for vacation does that necessarily mean that they did it intentionally; it may be a mistake on their part. If both inferences are equally likely, the court will likely consider negligence over intentional causes.

Sometimes, the insured could destroy evidence to cover up an accidental cause. This makes such losses appear intentional because altering the evidence affects the credibility of the insured. However, it does not necessarily prove that the damage was deliberate.

In water losses, you don’t typically deal with many witnesses; you rely on the insured to tell you what happened. However, as a solicitor or investigator, you may be in a position where you have to disprove what the insured is telling you.

How to investigate water losses

Causation is key

You need to know how the loss occurred, not just the mechanism. For example, you need to know precisely what caused a plumbing component to fail. Loss mechanisms are the same for negligent and intentional losses, so you need to conduct an in-depth investigation to determine the extent of the failure, as well as its origin.

You’ll require an expert to look at the physical evidence directly. Sometimes, the loss mechanism might be perfectly evident, but the exact cause warrants further analysis. Several types of water losses lead to various questions that can only be answered with the help of an expert. An expert will be better positioned to dig into exactly what happened in and around the area of loss and the rest of the house and help you assess whether the claim could be fraudulent.

Investigate early

You’ll want to conduct the investigation immediately after receiving the claim report. This is to ensure that the physical evidence is available and is not disturbed any more than necessary. An early investigation will also allow the engineer to be on-site for the inspection.

We’ve dealt with claims where a contractor informs the homeowner of the leak’s origin and then removes the part to send it to the engineer. While these may not be fraudulent claims, they prevent the success of our investigations. Upon receipt of the failed component, the engineer may determine that the leak did not occur at the original site of failure. Removal of that component, therefore, means evidence is no longer available for a conclusive determination of the loss. So, make sure your expert looks at the scene as it is.

The adjuster also needs to work at the outset of the claim. Early investigating allows all parties involved to get the freshest information from your insured, including maintenance and installation details. Insureds are typically more motivated to help you at the beginning. If you are primarily concerned about fraud or intentional causes, you must get the insured’s story earlier because they won’t have a chance to change it if they are lying. Tweaking their story to account for discrepancies leads to a further basis to suggest that they’re not a credible witness.

Focus on subrogation

The focus on subrogation allows you to look at the cause objectively, which in turn helps you determine if a claim is fraudulent. On the other hand, a strict focus on coverage might lead to the question of whether the insured is at fault. While this is an important question, it doesn’t help you objectively determine the cause of a loss.

The information provided by your engineer will help you determine the express cause of the loss. All that information will lead you to whether a loss is intentional, so there would be a basis to deny coverage. If the loss is unintentional, objectively analyzing the evidence and information provided will help you determine the likely cause.

Altering evidence

Case study 1: Faucet water supply line

Figure 1: A flex hose with failed steel braiding (left). A close-up of the site of failure (right)

A homeowner submitted an insurance claim after a flex hose failure. The industry had several issues with flex hoses years ago. While these failures still occur, they are much rarer than before, and the older flex hoses usually fail.

All flex hoses have steel braiding, an essential component of the hose. Failure of this component could cause the interior rubber hose to burst because the rubber on its own does not have sufficient strength to withstand depressurization.

The exterior of flex hoses can corrode naturally if exposed to a lot of water or other corrosive chemicals. The metal braids are made up of tiny individual strands, making them susceptible to damage, even after mild exposure to corrosive substances.

Figure 2: SEM images of the strands in the failed hose.

We used a scanning electron microscope (SEM) to examine the ends of the steel strands. The right-hand side image shows the material’s smearing, which indicates a mechanical force. The defamation observed was consistent with cutting.

Figure 3: An example of a flex hose that corroded without mechanical force.

Figure 3 shows examples of a naturally eroded flex hose strand. As opposed to figure 2, the strand has no smearing. However, some deposits throughout the end made it brittle, so it fell apart without deformation.

Our investigation revealed that the homeowner or tenant cut the metal braids to cause the water loss or cover up another loss. While this case was a blatant example of altering the evidence, it took a relatively extensive investigation to determine the cause. The SEM made it much easier to identify alterations in the proof because it wasn’t apparent at first glance.

Case study 2: Isolation Valve

Figure 4: The damaged isolation valve

A contractor was replacing the fan coil unit when water discharged from the isolation valve that is connected to it. The contractor, who reported the loss, claimed that he closed the valve, but there was no internal ball valve within. The investigation determined that the ball had been forcibly removed from the interior of the valve.

Figure 5: Observed damage to the internal threads on the valve’s ball.

Presumably, somebody used a pair of pliers or another tool to grab the valve and pull the ball out. Therefore, it was likely that the contractor dealing with this fan coil unit didn’t know what he was doing.

Figure 6: Evidence of other tool marks on the other side of the valve, which led to more suspicion.

There were two plausible scenarios in this case:

Insurance fraud

Case study 3: Fictional Leak

Figure 7: The area that allegedly sustained water damage.

A homeowner reported a water loss to the insurer, claiming that there had been flooding in an upper-floor bathroom. Additionally, the homeowner argued that water from the flooding flowed down and caused severe water damage to the basement. This was another case of a failed flex hose.

In his claim report, the homeowner said he had discovered the problem, shut off the water supply to the flex hose, and then replaced it. This is not an ideal scenario for insurers, adjusters, or solicitors. The insured would be expected to retain the failed hose for further inspection by an engineer. The insured claimed that he discarded the hose, which was cause for concern on our part.

Figure 8: A closeup of the area beneath the sink.

During the investigation, our experts saw few signs of an actual leak. In figure 8, the left-hand photo shows that everything was perfectly dry under the sink, which is inconsistent with a leak. In addition, there was no expansion or buckling of the wooden cabinetry on the tiled floor next to the sink. Had the leak been real, there would be signs of some water influx into the cabinetry in the joints.

Figure 9: The bathroom floor, showing no sign of damage (left) and the inside of the floor register, filled with dust and construction debris (right).

As shown in figure 9, there was no evidence of moisture in any part of the bathroom floor. This confirmed that there was no leak in the area, especially one that could potentially reach the basement floor.

Figure 10: The ceiling space (left) and the kitchen downstairs (right)

None of the areas in figure 10 had evidence of water infiltration either. The chandelier was significantly dusty, indicating that it had not come into contact with water. The basement flooring and baseboards had already been removed when the investigators arrived.

Figure 11: The chandelier (left) and the basement floor (right).

Contrary to the evidence, the basement may have suffered water damage at some point. Presumably, there was water damage somewhere in the basement and the insured attempted to cover it up as a flex hose failure. Another possibility is that it was a blatant attempt to make a false claim after they’d already removed the flooring and baseboards. Further investigation also showed that there was no real evidence of a water loss upstairs.

Case study 4: Freezing

Figure 12: The disconnected thermostat (left) and its internal mechanism (right).

This loss occurred in a seasonal home when the insureds were not present. They discovered a water loss that led to a freeze-up. The homeowners claimed that the furnace had malfunctioned, causing the house to get too cold and freezing the pipes.

By the time experts arrived to inspect the scene, the insured had disconnected the furnace and moved it out of the area. Unfortunately, they had also disconnected the thermostat, making it impossible to pull any history from it. As such, there was no way to investigate the temperature setting at the time of the loss.

After inspection of the furnace, the investigator determined that it worked perfectly. It was bone dry inside, and there was no evidence of malfunction or water damage, which you would typically expect in a freeze-up.

Figure 13: The inside of the furnace.

The furnace is typically in the house’s basement, where the water collects. Any water coming down from floor registers will make its way into the furnace, and you’d expect to see some water damage there. In this case, it was bone dry and perfectly functional. While there was no specific evidence because the thermostat was not available for detailed testing, investigators couldn’t determine whether the insured had turned the thermostat off, set it to an absurdly low temperature, or just flipped a switch and turned the furnace off. There was no evidence to suggest that the furnace shouldn’t function.

Case study 5: Freezing II

Figure 14: A bathroom wall has been taken apart to show the pipes.

A homeowner claimed that there had been a freeze-up that led to a pipe burst, causing several water issues. Only one fitting appeared to have been impacted by the loss, which was suspicious. The freeze-up didn’t seem to affect anything else, which was unusual, especially given this is an interior wall. In typical freeze-ups of this nature, the whole house would get so cold that more components would be affected.

Our extensive examination determined that the fitting had been cut and re-set in place without being properly connected. So, when the water pressure increased, the fitting flew open on its own and caused the flood.

These cases are merely examples of water fraud investigations. While these are the most common, they are not a comprehensive list of water losses that occur regularly.

We encounter both legitimate and fraudulent break (B&E) incidents. Therefore, one needs to investigate these instances to confirm the kind of B&E case in each claim.

Reasons for B&E claims

During B&E investigations, alarm systems and CCTV video footage can be used to extract information. These could provide information regarding the timing of an incident, at the very least. They might show general business operation trends, how the property is typically protected when vacant, or who typically has access to the premises.

More sophisticated CCTV equipment can be tied to a point-of-sale (POS) system. These are better known as video and transaction matching. Systems this sophisticated allow point-of-sales transactions to be automatically matched with surveillance video. Essentially, the surveillance video image is a bookmark of the time when an event or a transaction occurred. This could be an additional avenue in adjusting claims.

These advancements in technology have significantly improved the investigative process. For example, an alarm system and video images could provide information about who, how, and when someone entered a building. An alarm system could also provide information that may confirm coverage under a policy. Both systems could corroborate that an incident did take place.

POS systems

Figure 1: A screenshot of a POS system matched to the video equipment.

Figure 1 shows a cash register of a fast-food outlet. This system tells you what was purchased and how it was paid for. It provides a wealth of knowledge that is beyond invaluable during investigations.

Where to find video evidence

We can obtain information from video equipment installed on the property and outside a building. Information can also be obtained from cameras installed next door if the neighboring building has video equipment outside. Doorbell cameras across the road from the property can also help greatly.

Dash cams usually operate when a car is in motion. However, some will continue to record while the vehicle is parked. Therefore, you could get vital information if you asked a neighbor about their dash cams. In addition, social media outlets such as YouTube and Instagram could also be a wealth of knowledge.

General red flags relating to alarm systems and video systems

1. An alarm or CCTV system is tampered with

Communication lines can be cut outside or inside the building. These phone lines are used for the alarm system to communicate with a remote monitoring station. Therefore, investigating these could help determine if the landlines were tampered with.

Cell services utilized by alarm systems can also be blocked with a jamming device. These devices are cheap and readily available for purchase. As such, spending time to investigate this possibility may help deal with the client.

2. Motion detector or camera operation hindered by unusual placement of contents

Placing or piling contents against motion detectors can indicate foul play because it renders the devices ineffective. In these cases, the insured may place a floor-to-ceiling product in front of a motion detector to hinder its operation. But, again, this can be done before the incident happens.

3. Door contact hardware was repeatedly defective

Defective hardware in the property entrances enables intruders or the insured to open the door without triggering an alarm system.

4. By-passing of specific alarm zones

People familiar with a property can bypass zones so that their presence in these areas is indetectable by an alarm system. Even when the alarm system is armed, it won’t be triggered in these scenarios. You need to investigate that because telltale signs can be found to suggest that zones have been bypassed moments or days before an incident.

5. Smash and grab

This refers to the suggestion of someone breaking into the property, rushing to the location of an alarm to smash the alarm panel off the wall, and defeating its operation before the entry delay sequence of the alarm system has elapsed. This prevents the alarm panel from communicating with a monitoring station.

Questions to ask in smash and grab scenarios

How is the location of the alarm panel known to the perpetrator?

These possibilities can only be confirmed if time is taken to investigate the alarm system following the incident, assuming that the perpetrators left behind the alarm panel.

6. The alarm panel is removed

Occasionally, the alarm panel is removed from the building during the break. Therefore, an adjuster must consider the potential reasons for removing the alarm panel. The same goes for removing a digital video recorder or a network video recorder during the break-in. One must question if the removal of this equipment is meant to hide the perpetrator’s identity and investigate accordingly. In addition, some alarm systems have varying time delay entries. For instance, it may take 30 seconds for an alarm to go off after admission or longer. Perpetrators familiar with the property often remove the alarm panel within this time delay.

Questions to ask
7. Weaving a story

The suggestion of an alarm system and CCTV system not working during the incident is another red flag. For example, an alarm company may get phone calls about the alarm system not working on the days leading up to a B&E. This could either be a setup or a genuine concern from the owner. However, a further investigation is required because it may allow for subrogation potential against the alarm company to be assessed. A detailed study also helps the adjustor determine if they can confirm coverage on the policy relating to the alarm warranty.

The same trend can be seen with security cameras. They are reported as malfunctioning and then get turned off. The homeowner may sometimes suggest that the digital video recorder was not operational. Others might claim that they don’t use their video equipment to record. Instead, they only use it to watch the screen. This is always odd and calls for further research during investigations.

Case study 1: Personal lines – fire incident

Figure 2: A large house that experienced a fire.

A fire was discovered at approximately 02:00 pm on August 27, 2009. The family had left for Niagara Falls at 11:30 am. The son-in-law stayed with them at the house but left the property at 10:45 am on the same day.

The house was reportedly locked and secured. An alarm system was installed but was not running or set. There was video equipment installed, but they claimed it was not functional. The DVR was thought to have not yet been set up by the installation company.

The son-in-law claimed he would use the cameras to watch the front door from his TV when the doorbell rang. During a discussion with the son-in-law, he indicated that he had issues with some people in the past. However, there was no telling if he was weaving a story. Therefore, we obtained authorization to enter the scene and investigate.

Figure 3: A photograph of the front door.

The stairs in the front hallway leading up to the second level showed evidence of substantial fire damage.

Figure 4: A close-up of the front door.

As shown in figure 4, there was also some physical evidence of the door having been kicked in.

Figure 5: A photograph of a portion of the house.

We brought in our canine unit and had two dogs search the home. We searched all three levels of the house and found several areas of origin. Our dogs both hit on several places in the basement, the main level, and the upper level. Fire debris samples were collected and sent to a lab for chemical analysis. The samples showed evidence of the presence of gasoline. There was also evidence of forced entry.

Based on the fire investigation, it was quite evident that this was an incendiary fire. More fire debris was found in the basement, more so than in other levels of the home. In addition, a DVR digital video recorder was also partially submerged in water. This DVR was connected to several cameras. Despite the owner’s claim that it was not operational, we decided to secure the DVR and investigate further.

Interestingly, police authorities and the Ontario Fire Marshal’s Office conducted the investigation ahead of our attending the site. However, as they were told that the DVR was not functional, they did not secure it as evidence, giving us the potential to obtain some interesting information on the video images.

Figure 6: A screenshot obtained from the video.

One of the videos we obtained from the DVR showed someone coming in and out of the house. The person was trying to kick out the door. He picked up a brick and tried to smack the door. Eventually, he fell right into the house. This person created the conditions to show that the front door was forced open. The video showed that the person lit a piece of paper and threw it into the front door.

Figure 7: Another screenshot from the video shows the fire department’s arrival.

As the fire department arrived, smoke came out of the house’s front door in the DVR footage. We discovered that the individual breaking into the house and setting the fire in the video images was the son-in-law. We reported this information to the police, who then secured the video images from us. They used these images to charge the individual with arson.

Case study 2: Commercial lines – B&E incident

Figure 8: The commercial property.

This incident was reported to the insurance company as a B&E with items vandalized and products removed or stolen. The insured said he left the building at the end of the workday on February 16, 2018. He was alone and did not arm the alarm system before leaving the premises. He claimed that he often did not arm the alarm system when he expected an employee to come in after hours. All employees and cleaners had their alarm code, so we could tell who disarmed or armed the alarm system.

Cleaners arrived at the building on February 18 and discovered the business had been robbed and vandalized. The owner suggested that the rear door would occasionally not engage or latch shut to the panic bar. Further, he said a gap at the top of the door could allow someone to pry it open. It was, therefore, upon us to determine if this information was being set up to justify that a break-in, whether legitimate or not, had occurred.

Figure 9: The inside surface of the door latched onto the panic bar.

Contrary to the owner’s statement, the door had contact with the panic bar and did not indicate a malfunction. The door formed part of the alarm system.

Figure 10: The alarm system.

All doors were contacted. There were motion detectors within the building and in various areas, including both offices, the warehouse, and the storage and workshop areas. Part of the investigation involved confirming if the door could be open from the outside, given that the panic bar reportedly did not latch properly.

Figure 11: Scuff marks observed on the door.

We looked for pry marks that might indicate that someone had gained entry into the building. We saw some scuff marks, but nothing that would suggest that someone pried the door open. So, there was no clear evidence of someone forcing their way into the building.

Figure 12: A photograph of some of the equipment installed within the commercial property.

There was graffiti on the equipment inside the building and evidence of the place either being burglarized or products being removed from the building. This turned out to be a red flag, mainly because the alarm system was not armed on the day of the incident.

When we interviewed some of the employees, we discovered that the owner always armed the alarm system when they left with him at the end of the business day, which was daily. They always saw him arm the alarm system, but he didn’t that day. Cleaners also confirmed that the alarm system was typically armed when they arrived to conduct their cleaning duties.

The alarm investigation

To corroborate or dispute the information relating to the activation of the alarm system, we reviewed and analyzed its information. In addition, we obtained a detailed report from the alarm company.

The three months of historical Alarm System Monitoring Station reports showed that the alarm system was always armed over a weekend. Getting a few months of records to show the trends and habits relating to the alarm system usage is essential. Unfortunately, alarm reports of the day of the incidents are often of little value to the investigation.

We also downloaded the event buffer from the alarm panel to corroborate information from the monitoring station report. An event buffer stores information relating to the activities of the alarm system. We accessed and analyzed data in the panel with the information transmitted in the monitoring station. This is especially important when there is an issue with communication lines and the cellular service being interrupted.

When phone lines are cut, or communications defected, one can usually rely on stored information within the event buffer. There are many instances where alarm systems are not programmed to transmit when they are armed or disarmed. So, you can rely on the event buffer to determine whether an alarm system was armed, when, or who armed the alarm system.

The event buffer will typically have more information than perhaps the monitoring station. However, one must rely on both sources of information. It’s equally critical to obtain this information promptly. Otherwise, you risk essential information being overwritten within the event buffer. Event buffers act as a first-in, first-out queue, meaning older information is deleted to make way for new data.

In this instance, we tested the alarm system to confirm that any entry through one of the exterior doors would result in alarm activation and an annunciation to the monitoring station. First, we armed the procedure several times and simulated entering the building. Next, we opened the exterior doors and walked through several areas where items appeared to be vandalized or removed to see how the alarm system would operate. We also checked if signals were transmitted to the monitoring station.

This test revealed that the system had been armed and would have functioned as intended. In other words, someone gaining access into the building through that door would have triggered a door contact and several motion detectors within the building. The incident only went unnoticed by the monitoring station because the alarm was not armed. Consideration at that point would be given regarding the coverage based on the fact that the alarm system was not armed at the time.

Lessons learned

The biggest lesson, in this case, was the importance of downloading the event buffer promptly. The alarm company can facilitate this by doing the manual download at the premise or through a remote online access feature. So, one should ensure that the alarm company cooperates and that one of their technicians attends the scene. If phone lines are still operational, an alarm company technician is not required at the location; they can retrieve the information directly from the buffer.

If the alarm company is not cooperating, the alarm panel must be powered down to avoid losing vital information from the event buffer. When the alarm panel is powered down, data in the system will not be overwritten.

The same goes for security cameras, digital video recorders, and network video recorders. Video images can be overwritten in time. So, acting quickly will preserve substantial evidence and information.

Catastrophic global events often lead to an increase in cases of fraud. This was evidenced in the 2008 recession, during which we statistically saw a significant rise in arson claims. We have seen the same trend since March 2020. However, we don’t look at every claim we investigate as potentially fraudulent because we’re in a recession.

A forensic expert needs to look at the physical evidence with no bias or preconceptions. Then, we must translate what this physical evidence expresses into a thorough report. This helps clients apply that information to their policy, whether to determine coverage, subrogation possibilities, or liability.

Background and discovery information

Every investigation starts with a collection of witness statements from the fire department and police reports. Discovery information also includes servicing history, history of the vehicle, and the vehicle’s performance before the fire. We ask for the vehicle accident history from the insured or through a CARFAX.

Photos are also invaluable during investigations. We ask for any pictures taken just before, during, and after the fire. It’s important to know what the reported condition and use of the vehicle were before the fire.

Before examining a vehicle, forensic experts also search for recalls, technical service bulletins, and blogs related to the vehicle’s year, make, and model. At times, an investigation will require the determination of the wind effects. In those cases, the vehicle orientation and fire time are crucial information. We will also want to know if the scene is still available for some fires.

Documenting vehicle fire scenes

The first step to documenting these scenes is confirming the VIN. If a VIN can’t be verified, a forensic expert will apply the same principles as structure fires. This means beginning the vehicle examination from the outside and working your way toward the most significant damage area. It’s crucial to note that the area of greatest damage isn’t always the area of origin; it could result from ventilation or fuel load.

If possible, the vehicle examination should take place at the fire scene. However, there is often a better possibility of origin and cause determination when examining a vehicle where the fire has happened for two reasons:

1. Surrounding fire patterns around the vehicle will show the wind effects and the surrounding fuel loads.
2. Evidence that has fallen from the vehicle can be retained. When a car is moved, evidence can be lost in the debris.

It’s often impossible to examine a vehicle at the fire scene because it has to be towed away if it’s being driven at the time. The process of documenting vehicle fire scenes stays the same no matter the circumstances. The more faithful we are to this process, the more vivid the evidence of fraud becomes, and the stronger the technical opinion of a forensic expert.

Total burns and stolen and recovered vehicles

When a vehicle has been burnt to a crisp (total burn) and stolen and recovered, crucial physical evidence is hard to analyze. However, several factors and techniques can significantly improve the evidence analysis.

Depending on the age of the vehicle, a locksmith can assist with door locks and ignition cylinders to see if a key was used. In addition, they often have access to the manufacturer’s specs and aftermarket security installations.

Depending on the extent of damage, the infotainment module may be downloaded and compared to the reported discovery and background information. Moreover, we can determine the pre-fire condition of the engine and transmission by analyzing the fluids. Fire debris for flammable liquids needs to be collected soon after the fire because it can evaporate. Therefore, it’s best to manage it within days because it increases the chances of getting an accurate test result.

It’s crucial to remember that fire suppression water will dilute and flush away the accelerant. As a result, it can destroy and throw evidence 50 to 100 feet away from a vehicle.

When investigating a fire, the origin must be determined through various means before thinking about possible causes.

Personal line case study 1

Figure 1: The vehicle’s dash area

The reported information was that smoke was discovered coming from the dash area. The driver exited the vehicle and called 911.

Working from the areas of least damage to those of most damage, we discovered some surface scorching to the dash. But there was much more damage below the area left of the passenger footwell.

Figure 2: A photo taken from the driver’s side footwell.

Figure 2 shows a similar amount of fire damage low in the dash. Again, this is similar to what was observed in figure 1.

Figure 3: An image of the passenger footwell.

During the examination, we saw melted plastic in the passenger footwell. The remains of the HVAC fan and its blades were also found in this area. The fan blades had fallen from their installation site. However, the dash above the area observed not much fire damage. None of the wiring harnesses or other components showed a high degree of fire damage.

Figure 4: After melted plastic was removed, the center lower area of the dash.

After the melted plastic was removed, the center lower portion of the dash was examined. Wads of napkins were discovered in the area of fire origin, and there was no evidence of an accidental ignition source. The insured could not explain why there were wads of napkins in an inaccessible area of the enclosed dash unless panels and carpeting were moved out of the way.

Personal line case study 2

Figure 5

The reported information was that the vehicle was driven when the owner noticed smoke escaping the passenger side dash. He pulled the truck over, called 911, opened the front passenger door, went around, and moved away from the vehicle.

The fire patterns observed in the examination did not support a fire starting inside the dash. Instead, it seemed like a fire had burned in the footwell or on the seat and attacked the dash. In addition, the components inside the dash cavity were in good condition. Therefore, if a fire started inside the dash, these items would be damaged and consumed before the fire even spread to other parts of the vehicle.

Figure 6: The excavated footwell

The footwell was excavated, and a large amount of packed and folded cardboard was discovered in the area, along with aerosol cans.

Figure 7: The cardboard layers discovered during excavation.

Permission was provided to remove the infotainment system, which was in excellent condition.

Figure 8: The infotainment module.

The download of this module showed that the vehicle had been pulled over at this location for about 16 minutes, with the car running and the doors opening and closing before the fire, causing the data to stop being recorded.

Figure 9: The report obtained from the infotainment system.

The driver had reported that he smelled, then saw smoke escaping the dash, pulled over, and called 911 at 1:38 pm. The bottom axis in the report shows the time and date, and the left axis shows the vehicle’s speed. There was no documented traveling of the car after 01:20 pm on the infotainment download.

The vehicle stopped moving at about 01:16 pm that day. The fire department report showed they were on the scene at 02:05 pm. The infotainment download showed that the vehicle was pulled over at 01:16 pm, and the truck didn’t move after that time. The only activity was doors opening and closing.

Commercial case study 1

A commercial vehicle was being driven when the driver reported some warning lights and smoke entering the cab from the dash area.

Figure 10: The engine compartment of the vehicle.

The reported information was that the vehicle’s owner was pulled over on the side of the road. When a passing tow truck pulled over, the driver jumped out, grabbed his fire extinguisher then quickly and efficiently extinguished the fire.

Upon arrival at the scene, we noted that the origin was small and located in the engine compartment beside or inside the fuse block.

Figure 11: The exterior of the fuse panel.

Some surface deformation and scorching to the exterior of the fuse panel were observed. However, this distortion to the material and the effects of heat were only present on the external surfaces. The areas adjacent to the affected location were utterly unaffected by the fire, indicating a very targeted application of flame on the surface.

Figure 12: The wiring harnesses in the fuse block, with insulation.

We examined and thoroughly documented the fuse block’s plastic body and the area’s wiring harnesses. First, we examined the wiring harnesses and began with the exterior protective cover (the loom). The loom protects the wiring harnesses located inside the fuse block. Next, the exterior and interior surfaces were examined after the removal of all sections of the loom. This allowed us to examine the wiring and insulation inside and on each of the conductors inside the harnesses.

Figure 13: The internal wiring.

Once all the charred material and loom were removed, there was no evidence that any of the wirings had failed. Inside each strand in figure 12 is copper wiring, where the current flows. In addition, each conductor has a sleeve of insulation. In this case, only surface charring of the loom and some minor heat damage to the insulation in some of the individual conductors were present. Therefore, we concluded that the only good ignition source for this fire was the direct application of flame.

Commercial case study 2

Figure 14: An image of the top surface of the hood.

A truck was parked in the operator’s driveway when he got alerted to the fire by a neighbor in the middle of the night. The truck hadn’t been driven in a few hours, eliminating the possibility of hot surface ignition as an accidental fire cause. The only other options were electrical or intentional ignition.

To determine the fire’s origin, we compared the fire damage and corrosion effects on the interior and exterior surfaces of the hood, the right fender, and the bulkhead at the base of the windshield. The top surface of the hood had orange corrosion occurring.

Figure 15: The underside of the hood.

The underside of the hood had minimal corrosion effects at the back-end edge, close to the base of the windshield. However, the underside did not show the extent of corrosion observed on the top surface of the hood. This indicated that the fire possibly originated on the vehicle’s exterior and not inside the engine compartment. This was the first clue that the fire may have been intentionally set.

Figure 16: The area of fire damage.

The fire damage in the right rear quadrant of the engine compartment had a considerable amount of electrical wiring that needed to be examined for evidence of electrical failures. An energized wire could provide proof of an arcing loss resulting from the fire spread. In this case, there were no electrical failures in the general area of fire damage.

The fire burned intensely on the vehicle’s exterior surfaces from an accelerant being poured. In contrast, there was less fire damage and loss of material inside the engine compartment.

Figure 17: The passenger fender.

The passenger fender showed the effects of an accelerant burning on the exterior surface. However, the side of the fender facing the tire and the engine compartment had less loss of material in comparison.

These case studies indicate that physical evidence is the most critical aspect of vehicle fire investigations. As a forensic expert, you don’t have to factor in the insured’s intent because it is outside the scope of your inquiry. However, legal experts must carefully determine the purpose where necessary.

The arson triangle

Typically, people steal vehicles to drive or tear them out for parts. So, a car with significant fire damage is a major cause for concern. Vehicle fires, as a result, always warrant an extensive investigation that considers these three points:

1. Proof of a deliberately set fire
2. Motive
3. Opportunity

We rely on forensic experts to show that there’s an incendiary fire. Motive, the second part of this triangle, is inevitably financial. The financial reason is often demonstrated in documents or other investigations. The third part of the arson triangle answers the question of who had the last or best chance to be on the fire scene. Cell phones and video surveillance have made it easier to determine when people were at the scene, which often turns out to be a vital part of the analysis.

Statutory condition 6 is your friend

Statutory condition 6 allows an insurer to submit an examination under oath. You can have you’re insured examined to produce reasonable evidence. Using this statutory condition, an insurer can obtain financial or maintenance records, amongst others. Obtaining bank records or a credit card history of the insured, for example, could help determine the motive. Vehicle records could also help determine the reason for arson.

Case study

Figure 18: The burnt vehicle.

The insured reported a vehicle stolen from the driveway during the night and was found burned the next day. The fact that the car was found burned was a cause for suspicion. In this case, investigators determined that an accelerant was used to start the fire in the vehicle’s backseat. This determination met the first requirement of the arson triangle – confirmation of an incendiary fire.

Statutory condition 6 was used to get an undertaking to obtain maintenance and bank records. The maintenance records showed that the vehicle was in the shop every other month for fairly serious repairs, and the insurance still owed money on the purchase. In addition, the vehicle needed a new transmission at the time of the incident, and the estimated cost was approximately $4,000. So, a significant payment was on the horizon if the owner wanted to keep the vehicle.

The bank records showed that the insured was in a financially precarious position. He was overdrawn on his bank account and had credit card debt. So, there was a financial motive as well.

The vehicle was in the insured’s driveway, and the owner had the only set of keys at the time. When looking at a vehicle fire, you always want to start with the keys for the opportunity element – who had the keys or access to the keys?

All the elements of fraud were present in this case, and the claim was denied. However, the insured continued with the claim. Our experts continued their investigation because it appeared that the case could go to court. In addition, the investigators spoke with the ex-girlfriend of the insured, and she knew of the entire plot to burn the vehicle. She gave us a signed statement where she detailed what occurred.

The insured returned with his ex a few months later and tried to resurrect the claim, but we already had the signed statement.

This example underscores the importance of detective work. You must ensure that you’re turning over every rock during the investigation and doing so fairly and comprehensively. People who commit these crimes also tend to talk to their loved ones. And so, interviewing the right person is a big help. Social media dramatically assists you; you can find the insured’s close friends.

Key takeaways
Contact Origin and Cause for Vehicle Fraud Investigation Today!