OSINT Best Practices

Learn OSINT best practices for claims investigations, including source verification, evidence preservation, privacy, and responsible reporting.

By Caroline Caranante | Oct 14, 2026 | 3 min. read

What you will find below:

What Is OSINT in Claims Investigations?
Define the OSINT Objective Before Searching
Verify OSINT Findings Across Multiple Sources
Preserve and Document Online Evidence
Follow Privacy and Legal Guidelines for OSINT
Interpret OSINT Findings in Context
OSINT Best Practices for Claims Decisions

OSINT can help claims teams verify details and spot inconsistencies, but only when it is done carefully. This post covers best practices for source verification, evidence preservation, privacy, and responsible reporting.

What Is OSINT in Claims Investigations?

Open-source intelligence (OSINT) involves collecting and analyzing publicly available information to support an investigation. Sources can include social media, news articles, public records, business listings, and online marketplaces.

In workers’ compensation and insurance claims, OSINT helps investigators verify details, identify inconsistencies, and find information that may require further investigation. Claims professionals can use these findings alongside other evidence to make informed decisions.

Define the OSINT Objective Before Searching

A clear investigative objective keeps OSINT focused on information relevant to the claim. Investigators should start with a specific question, such as whether a claimant’s public posts align with their reported activity limitations. A general search without a defined purpose can lead to irrelevant findings and wasted time.

The OSINT Foundation’s 2026 guidance recommends starting an investigation by identifying the most important questions to answer.

A clear objective also helps investigators avoid collecting unnecessary information, save time, and produce findings that are easier to review.

Verify OSINT Findings Across Multiple Sources

Investigators should verify online findings before treating them as reliable evidence. A single post, photo, or profile may not tell the full story, so investigators should look for supporting information from other sources. The Berkeley Protocol, an international standard for digital open-source investigations, identifies verification as a key step in the investigative process.

In claims investigations, verification includes:

Confirming identities: Use multiple identifiers to determine whether a profile belongs to the correct person rather than relying on a name alone.
Checking dates: A photo posted today may show an activity that took place years ago.
Comparing sources: Look for supporting details in records, surveillance, statements, or other available evidence.
Documenting uncertainty: Clearly label unconfirmed information in investigative notes and reports.

Investigators should also check images for signs of manipulation. Generative AI can create realistic images that misrepresent events or exaggerate damage in insurance claims. Investigators should compare images with other available evidence before drawing conclusions (Chandrasekhar et al.).

Preserve and Document Online Evidence

Investigators should document online findings promptly because posts, profiles, and other content can change or disappear. Preserving relevant details helps others review the findings and understand where the information came from.

Records should include:

The full URL and platform
The date and time the content was captured
The date the content was posted
The account name and profile link
Relevant captions, comments, and tagged accounts
Who captured the content and how it was collected

A screenshot alone may not provide enough information to verify the source or determine whether the content has changed. Investigators should record the source and capture relevant details to help verify the content later. The National Institute of Standards and Technology (NIST) identifies digital evidence preservation as an important challenge.

Evidence requirements vary by jurisdiction and legal proceeding, so claims teams should consult legal counsel about proper preservation practices when litigation is possible.

Follow Privacy and Legal Guidelines for OSINT

Investigators must follow applicable laws, platform terms, company policies, and professional standards when reviewing publicly available information.

The District of Columbia Bar explains that attorneys can review a represented person’s public social media posts, but they cannot send friend requests or access requests to view restricted content. Attorneys also cannot use deception or false identities to access social media information. These rules address attorney conduct, and requirements vary by state.

Investigators should review public content, avoid deceptive practices or prohibited contact, and collect only information relevant to the claim. They should also consult legal counsel when questions arise about applicable laws or requirements.

Interpret OSINT Findings in Context

OSINT findings should support investigative decisions, not determine them on their own. A photo of a claimant at the gym, carrying groceries, or traveling may not tell the full story. The activity may be consistent with medical restrictions, the photo may be outdated, or the account may belong to someone else.

Investigative reports should explain what investigators found, where the information appeared, and when they captured it. Reports should also distinguish observations from conclusions. Comparing online findings with medical records, surveillance, statements, and other evidence helps claims professionals understand what the information actually shows.

Investigators should also verify potentially manipulated images rather than assume they are fake. Concerns about image manipulation should not lead to unnecessary delays or unfair denials of legitimate claims. Comparing images with other evidence helps investigators reach more informed conclusions.