2026-09-21

Don't scrub metadata from an insurance claim photo — what a real SIU fraud case and FBI data say about why not

Every other post on this blog says some version of the same thing: strip a file's metadata before it leaves your device, because whoever receives it doesn't need to know exactly where or when you took it. There's one common situation where that advice runs backward, and getting it wrong can cost more than an awkward surprise — filing an insurance claim. If a photo is the reason your claim gets approved, the same fields NearScrub and every other EXIF-stripping tool exist to remove — capture date, GPS coordinates, device identity — are usually the fields an insurer is relying on to believe your account in the first place.

What an SIU investigator actually pulls from a claim photo

Writing for Insurance Journal in March 2023, attorney Oner Kiziltan of the law firm Marshall Dennehey described exactly what a Special Investigative Unit (SIU) looks at once a claim photo lands on an investigator's desk: metadata carrying "author and dates of creation (and location, assuming the user has not disabled the location services feature in their device)." For a phone photo specifically, he named the same three things NearScrub removes from a JPEG for privacy reasons elsewhere on this blog: "the location at which the photo was taken, the date and time the photo was taken, and the identity of the phone that took the photo." This isn't one lawyer's private theory — the National Insurance Crime Bureau (NICB), the U.S. insurance industry's own anti-fraud trade group, runs training on exactly this. Its "Metadata for Fraud Investigators" session, held November 19, 2024 during International Fraud Awareness Week, teaches SIU staff where metadata "can be found and how it can be used when investigating claims," including in follow-up interviews and Examinations Under Oath.

The case that made the point for him

Kiziltan wasn't writing about metadata in the abstract — he described a case he had just worked. A claimant, given the pseudonym "Freddy Fraud" in the article, submitted damage photos and said they'd been taken the day of the loss. The photos' own metadata put the actual capture date two days earlier — before the policy covering the claim had even been purchased. Laid out on a timeline — photo taken Monday, policy bought Tuesday, claim filed Wednesday — that single mismatch was enough for the carrier to refer the case to Florida's Department of Investigative & Forensic Services, which sought a probable cause affidavit charging the claimant with fraudulent application to obtain insurance coverage and a false and fraudulent insurance claim, both third-degree felonies under Florida law. Kiziltan's own summary: "sometimes one small piece of metadata can be the final piece of the fraud puzzle." What actually broke the case wasn't the photo's visual content — it showed real damage — it was a timestamp sitting invisibly inside the file.

Why insurers built this scrutiny into the process at all

The scale behind that scrutiny isn't a rounding error. The Texas Department of Insurance's consumer fraud page cites an FBI estimate that non-medical insurance fraud costs "at least $40 billion every year" in the United States, a cost the department says gets passed back to "insurance companies, policy holders, and taxpayers... through increased insurance rates, higher taxes, and inflated prices." A cost that size is why SIU review of claim photo metadata isn't a rare, paranoid edge case reserved for six-figure claims — NICB trains investigators to check it as a routine step, the same way an adjuster checks whether a written description matches the photographed damage.

Where that leaves a metadata scrubber

NearScrub does exactly what its other posts describe: it strips EXIF/GPS, XMP, and IPTC from a JPEG or PNG, and the Info dictionary and XMP metadata stream from a PDF, entirely in the browser, before the file goes anywhere. That's the right move before a photo goes into a marketplace listing, a resume, or a document handed to opposing counsel — anywhere the recipient has no legitimate reason to know exactly where or when you took it. A claim photo is the mirror image of that situation: the timestamp and location aren't a leak risk to manage, they're the corroborating evidence the whole submission depends on. Run that same photo through a scrubber first and you don't get a "cleaner" claim — you get a photo that arrives looking exactly like the pattern Kiziltan and NICB train investigators to be alert to: real damage, but no capture date, no location, no device identity to check it against. That's not a flaw in NearScrub or any other EXIF tool — the tool is doing precisely what it's built to do. It's the wrong file to point it at.

The one question worth asking before you scrub anything

The rule that actually generalizes: don't ask "does this file have private information in it," ask "who is this metadata protecting me from, in this specific situation." For a photo going into a public listing or a document going to a stranger, the honest answer is usually "no one but me needs this," and stripping it is the right call — that's most of what this blog covers. For a photo whose entire job is to prove where and when something happened to the one party whose job is to verify that account, the honest answer is the opposite, and the metadata should travel with the file, not get removed from it before you ever submit it.