18.3 Privacy, Fraud, and Consumer Protection

The Privacy Framework

Insurers handle sensitive nonpublic personal information, and three federal/model regimes drive the national questions:

• Gramm-Leach-Bliley Act (GLBA) — requires financial institutions, including insurers, to give an initial and annual privacy notice describing information-sharing practices and to let consumers opt out of sharing nonpublic personal financial information with unaffiliated third parties.
• NAIC Privacy Model (Regulations 670/672) — the state implementation, distinguishing nonpublic personal financial information from health information, which generally requires an opt-in (authorization) before disclosure.
• Fair Credit Reporting Act (FCRA) — governs use of consumer/credit reports for underwriting; if an insurer takes adverse action (declines, raises rates, or cancels) based on a report, it must give an adverse-action notice identifying the reporting agency and the consumer's right to a free copy and to dispute errors.

Opt-Out vs. Opt-In and Adverse-Action Mechanics

The most tested privacy trap is the opt-out vs. opt-in line:

Under FCRA, an investigative consumer report (involving interviews about character or reputation) requires advance written notice to the applicant. When an insurer relies on a credit-based insurance score to decline or surcharge, the adverse-action notice is mandatory—omitting it is itself a violation, even if the underwriting decision was correct.

The NAIC also adopted a Model Act on the Use of Credit Information that limits how insurers apply credit scores: an insurer generally may not deny, cancel, or non-renew solely on the basis of credit, may not use disputed information while a dispute is pending, and must consider extraordinary life events (such as a serious illness or the death of a spouse) on request. These rules sit alongside FCRA, not in place of it, and a question may test the consumer's right to a free annual report and to dispute and correct errors that influenced a rate.

Insurance Fraud

Insurance fraud is a knowing misrepresentation made to obtain a benefit or payment not owed. The exam separates two directions:

• Hard fraud — a deliberately staged or fabricated loss (faking a theft, arson for profit, a staged auto collision).
• Soft fraud — exaggerating an otherwise legitimate claim (padding the value of stolen items, inflating repair costs).

Fraud can be committed by applicants/insureds (concealment on the application, false claims) or by producers/insurers (premium theft, fictitious policies, churning). Most policies contain a Concealment, Misrepresentation, or Fraud condition that voids coverage when an insured intentionally conceals or misrepresents a material fact, before or after a loss. Under the federal Violent Crime Control Act / 18 U.S.C. 1033-1034, insurance fraud affecting interstate commerce is a federal crime, and 1033 bars dishonest felons from the business.

Worked example: A homeowner files a burglary claim listing a $4,000 laptop that never existed alongside $6,000 of genuinely stolen property. The fabricated item is soft fraud (padding); the fraud condition can let the insurer void the entire claim, not merely the $4,000—materiality, not the dollar split, controls.

Most insurers run a Special Investigations Unit (SIU) and many states require one, plus a posted fraud-warning statement on applications and claim forms ("any person who knowingly files a false claim is guilty of a crime"). Materiality is the hinge concept: a misstatement is material if it would have changed the insurer's decision to issue the policy or pay the claim. An honest, immaterial error—transposing a digit in a phone number—does not void coverage; a knowing, material concealment does.

Consumer Protection and Required Disclosures

State insurance departments backstop consumers through several mechanisms the exam expects you to know:

• Complaint handling — departments log consumer complaints; complaint ratios can trigger market conduct exams.
• Guaranty associations — if a licensed insurer becomes insolvent, the state guaranty fund pays covered claims up to statutory caps (a common P&C cap is $300,000 per claim, varying by state and line). Producers may not advertise guaranty-fund protection as a sales inducement.
• Free-look / cancellation rights and clear policy-summary disclosures so consumers understand what they bought.
• Anti-fraud reporting — many states grant immunity to insurers and producers who report suspected fraud in good faith to the department or a fraud bureau.

The through-line of consumer protection is disclosure and good faith: tell the consumer the truth, protect their data, pay valid claims promptly, and report wrongdoing. Producers who follow those duties rarely face the penalties—fines, suspension, revocation, and federal bars—covered throughout the national portion.

Tie the privacy, fraud, and protection threads together with a single principle the exam keeps returning to: the consumer must be able to make an informed decision and trust that their information and money are safe. Privacy rules guard the data, fraud rules punish lies that distort the bargain, and guaranty associations and complaint systems protect the consumer when an insurer fails or misbehaves. A producer who memorizes the opt-out/opt-in line, the adverse-action trigger, the hard-vs-soft fraud split, and the guaranty-fund cap can answer most national consumer-protection items without guessing.