The case has (finally!) settled. After years of adversarial litigation, fiercely opposed parties now share a common purpose: to ensure that the settlement fund is distributed to the carefully defined class of claimants entitled to compensation. Unfortunately, this purpose may also be vulnerable to a shared threat: claims fraud.
By reducing geographic and economic barriers to claimant participation, online claims filing technology has largely furthered the access to justice objectives of the Class Proceedings Act, 1992 (“CPA”). The unfortunate corollary is that these barriers have also been reduced for bad actors keen on fraud and claims-filing abuse.
Section 27.1(15) of the CPA requires that the entity responsible for administering a settlement “shall administer the distribution in a competent and diligent manner”. While I can only speak from my experience at Epiq*, reputable claims administrators understand this standard to include a duty to develop and employ meaningful fraud-prevention measures.
Without providing a blueprint for the ever-opportunistic fraudsters, this article provides a high-level overview of some, but not all, of the tools that claims administrators may use to protect settlement funds from attempted fraud and abuse.
Securing the Settlement Website and Claims Portal
Controls implemented at the level of the settlement website identify and block suspicious activity before a would-be fraudster can even initiate a claim. Examples of these controls, as described in greater detail below, include IP block lists, geographic restrictions, web traffic pattern monitoring and rate-limiting validation tools.
Website-Level Protections
Responsible claims administrators maintain—and constantly update—IP block lists, which are lists of internet addresses associated with malicious activity, bot networks, or other abusive conduct. Administrators use these lists to pre-emptively prevent those IP addresses from accessing settlement websites. Similarly, administrators may use geographic restrictions to block website access from jurisdictions with no meaningful connection to a settlement program, particularly where a jurisdiction may also have a recognized history of cyber abuse. These initial, proactive measures help preserve system stability and can significantly reduce a settlement website’s exposure to automated attacks.
Portal-Level Protections
Human users interact with websites at relatively predictable rates, whereas bots can generate requests at volumes and speeds that far exceed human capabilities. Using web traffic pattern monitoring, administrators may screen settlement websites for usage that appears to be automated. Rate-limiting technology can then be employed to trigger user verification steps. These systems allow legitimate users to proceed once verification is completed, while automated interactions will be blocked before claim-related data is exchanged. Such measures can be used to defend against high-volume attacks aimed at settlement claims portals.
Fortifying the Claim Form
Fraudsters are tenacious, so responsible claims administrators recognize that even the most robust website protections must be accompanied by strategies to secure the claim form itself. Such strategies may include eligibility screening mechanisms, mandatory fields, and other data-validation controls. Employed together, these strategies can help identify incomplete, inconsistent, or potentially manipulated submissions before they enter the claims process.
Submission-Level Protections
Eligibility screening is a straightforward but highly effective strategy for preventing intentional (and unintentional) claims abuse. The claim form is simply designed to include threshold questions that will automatically bar a claim from proceeding where it is clear that the “claimant” falls outside of the settlement class.
Mandatory field requirements may also be used to prevent a claim from being submitted before all required information has been provided. Such requirements help reduce the likelihood of incomplete filings and can thwart automated attempts to improperly submit claims containing “placeholder” information.
By stopping obviously ineligible claims at the outset, administrators can focus exclusively on valid submissions that require meaningful review.
Completion-Level Protections
Administrators may also employ risk-based CAPTCHA technologies and hidden “honeypot” fields designed to distinguish legitimate users from illegitimate “bots”.
CAPTCHA tools analyze user interactions and request additional verification when suspicious indicators are present. Honeypots are hidden fields embedded within forms that are invisible to legitimate users but are often completed by automated s programmed to complete every field they encounter.
Together, these tools create additional barriers for bots while remaining largely invisible to genuine claimants.
Deterring Fraud, Not Legitimate Claims
While administrators must continue to be aggressive in their fight against fraud, these strategies must, of course, be balanced against the overarching goal of transferring settlement funds to the settlement class as fairly and efficiently as possible.
When implemented in a “competent and diligent manner”, fraud-mitigation controls can:
- improve class member experience through a straightforward and reliable claims process;
- increase claim quality and accuracy while reducing fraudulent submissions;
- promote greater consistency in claims assessment and outcomes; and
- reinforce public and judicial confidence in the administration of class action settlements.
By working to detect suspicious activity at multiple points throughout the settlement administration process, claims administrators can help safeguard the integrity of the settlement that the parties worked so hard to secure.
*Obligatory disclaimer that the views expressed here are my own and do not necessarily reflect those of my employer.
About the Author
Emilie Maxwell is a Director of Class Action Solutions at Epiq Canada.
Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.