Workers’ comp fraud surveillance holds up when it is lawfully obtained, continuously documented, and forensically preserved. Investigators observe a claimant only from public vantage points, never trespass or record private audio, capture unbroken timestamped video, and corroborate it with activity checks and open-source intelligence. Tied to the claimant’s stated medical restrictions and delivered with a defensible chain of custody, the footage authenticates itself and survives challenge by claimant’s counsel.
For carriers, third-party administrators, self-insured employers, and defense counsel, sub-rosa surveillance is one of the most powerful—and most misused—tools in a contested workers’ compensation claim. Done to an elite standard, it converts suspicion into evidence a judge and jury can trust: video of a claimant performing the very activities their treating physician declared impossible. Done carelessly, it produces footage that is inadmissible, an investigator who becomes a liability witness, and a claim that grows more expensive because the fraud allegation collapsed. This guide explains how world-class investigators build surveillance that survives every challenge, where the legal lines sit nationwide, and how carriers and counsel should scope the work. It is general information for decision-makers, not legal advice—confirm specifics with counsel in each jurisdiction.
What is sub-rosa surveillance in a workers’ comp claim?
“Sub rosa”—literally “under the rose”—is the insurance-defense term for covert, video-based surveillance of a claimant conducted without their knowledge. Its purpose is narrow and specific: to document a claimant’s actual physical capabilities and daily activities and compare them against the restrictions and disability claimed in the file. It is not a fishing expedition into someone’s private life. A claimant who says they cannot lift more than ten pounds, cannot stand for more than a few minutes, or is bedridden, but who is filmed loading landscaping equipment, coaching a youth sport, or working a second job, has created the single most persuasive evidence available in a contested claim: their own conduct, on video, contradicting their sworn representations.
Surveillance rarely stands alone. Elite investigations pair it with two adjacent disciplines. Activity checks are discrete, point-in-time confirmations of whether a claimant is home, active, or working, used to establish patterns and time the deployment of full surveillance. Open-source intelligence (OSINT)—including public social-media content, business filings, and public records—corroborates and extends what the camera captures. The claimant’s own public posts of a fishing trip, a gym session, or a side business frequently supply the roadmap for where and when video surveillance will be productive.
When does surveillance actually pay off?
Surveillance is expensive and should be aimed, not sprayed. The decision to deploy it—and when—separates carriers that recover from those that burn budget. The strongest returns come when specific red flags appear in the claim file and when the timing aligns with a pending medical or legal milestone.
- Inconsistent or escalating subjective complaints that outpace objective medical findings.
- Injuries reported Monday morning or immediately after a disciplinary action, layoff notice, or denied time-off request.
- No witnesses to an alleged workplace injury, or a delayed report.
- A claimant who is difficult to reach, misses appointments, or whose neighbors mention outside activity or a cash job.
- Physically demanding hobbies, a second occupation, or a side business visible in public records or social media.
- An upcoming Independent Medical Examination (IME) or deposition, where fresh, contemporaneous video sharpens the physician’s and attorney’s assessment.
Timing is a discipline of its own. Surveillance is most valuable shortly before an IME—so the examining physician can be shown current footage—and around depositions, where recorded activity can be squarely contradicted by sworn testimony. A common professional cadence is a small number of consecutive days that include a weekend, when claimants are more likely to run errands, travel, or pursue recreation, layered on top of the pattern that activity checks and OSINT have already established.
What makes surveillance legally admissible?
Admissibility is decided long before a case reaches a hearing. Two independent requirements must both be satisfied: the footage must be lawfully obtained, and it must be properly authenticated and preserved. Fail the first and the evidence can be excluded and the investigator sued; fail the second and even lawful footage is dismissed as unreliable or manipulated.
Authentication is the foundation. Video must be shown to be a fair and accurate depiction of what it purports to show, captured continuously and without deceptive editing. The professional standard is unbroken, real-time-stamped recording, complete with the mundane stretches—the drive, the wait, the periods of no activity—because gaps invite the argument that the exculpatory moments were cut. Each clip is logged in a contemporaneous surveillance log noting date, time, location, and activity, and every original file is preserved in its native format with a documented chain of custody, ideally hash-verified so its integrity can be proven. The investigator must be prepared to testify to the method: who recorded, from where, with what equipment, and that nothing was altered. This is precisely where a digital forensics discipline elevates surveillance—native-file preservation, hashing, and metadata validation turn raw video into evidence that withstands a motion to exclude.
Which investigative methods are used, and what limits apply?
“Surveillance” is a bundle of distinct techniques, and the law treats each differently. The table below summarizes what each method contributes and the principal constraint a disciplined investigator observes—constraints that a stricter state statute can tighten further.
| Method | What it establishes | Principal legal limit |
|---|---|---|
| Video surveillance (sub rosa) | Actual physical capability vs. claimed restrictions | Public vantage only; no trespass; no audio; no harassment |
| Activity check | Presence, patterns, whether claimant is working | No pretext that impersonates officials; no trespass |
| Social-media / OSINT review | Corroborating activity, side jobs, travel, hobbies | Public posts only; no fake-friend deception or account access |
| Public-records research | Business ownership, licenses, prior claims history | Permissible-purpose rules; no protected data misuse |
| GPS / vehicle tracking | Movement patterns | Restricted or criminalized on a claimant’s personal vehicle |
| Audio recording | (Generally avoided) | Wiretap/eavesdropping law; all-party consent in many states |
Where is the privacy line an investigator cannot cross?
Lawful sub-rosa work lives entirely within what a person knowingly exposes to public view. Cross that boundary and the footage is not just worthless—it becomes evidence of the investigator’s, and by extension the carrier’s, misconduct. Five bright lines govern the work.
- Public vantage only. An investigator may record what is visible from a public street, sidewalk, or other place they are lawfully entitled to be. Filming into the interior of a home, over a fence, or into a fenced backyard where privacy is expected can constitute intrusion upon seclusion.
- No trespass. Entering private property, a gated community, or an employer’s restricted lot to obtain footage taints it and exposes the investigator to trespass liability.
- No audio. Video is generally fair game from a public vantage, but the instant a device captures the sound of a private conversation, federal and state wiretap laws attach—and many states require the consent of all parties. Professional sub-rosa is silent.
- No harassment or stalking. Surveillance must be passive observation. Following too closely, confronting the claimant, or conduct that alarms them can cross into criminal harassment and undermine the entire investigation.
- No unlawful pretext or impersonation. Investigators may not impersonate law enforcement or government officials, and pretext that violates state licensing rules or federal financial-privacy law is prohibited. Any ruse must stay within what the jurisdiction permits.
Location tracking deserves special caution. Placing a GPS device on a claimant’s personal vehicle is restricted or outright criminalized in many states and echoes the constitutional privacy concern the U.S. Supreme Court expressed about prolonged location monitoring. Reputable investigators do not covertly track personal vehicles; they rely on lawful observation and public data.
How does social media and OSINT strengthen a case?
Claimants routinely document the very activities their claim denies. Public posts of a hunting trip, a marathon, moving furniture, or operating a side business are frequently the pivot on which a fraud finding turns. But social-media evidence is fragile if collected carelessly. Two rules keep it defensible. First, investigators access only public content—no fabricated “friend” requests to breach privacy settings, no pretext accounts, and no accessing password-protected material, which can violate anti-hacking and stored-communications laws. Second, the content must be preserved forensically: full-page and metadata capture, timestamps, source URLs, and hash verification, because a screenshot alone is easily attacked as fabricated or undated, and a claimant may delete posts once litigation heats up.
OSINT also extends beyond social media into business registrations, professional licenses, court records, and prior-claim history—the kind of structured public-records and cyber and open-source intelligence work that reveals an undisclosed second occupation or a pattern of similar claims. Corroboration is the theme throughout: the strongest cases weave surveillance video, social-media activity, and public records into a single, mutually reinforcing narrative that no single explanation can dismiss.
How do you run a sub-rosa investigation that holds up?
The difference between surveillance that proves fraud and surveillance that backfires is process. This framework reflects how elite investigators structure a defensible engagement.
- Define the objective against the file. Obtain the claimed restrictions, treating-physician reports, recorded statement, and any deposition testimony, so the investigation targets specific, documented representations rather than a vague hunch.
- Confirm licensing and jurisdiction. Verify that investigators are licensed where the work occurs and map each state’s consent, pretext, and privacy rules before anyone deploys.
- Scout with activity checks and OSINT. Establish the claimant’s patterns, likely productive windows, and any social-media leads before committing full surveillance hours.
- Time the deployment. Schedule around an IME, deposition, or a weekend window when activity is likeliest, capturing consecutive days for pattern rather than a lucky single frame.
- Record continuously and lawfully. Roll unbroken, timestamped video from a public vantage—no trespass, no audio, no editing out the dead time.
- Keep a contemporaneous log. Document date, time, location, weather, equipment, and every observed activity as it happens, in a report an investigator can defend on the stand.
- Preserve forensically. Retain original native files, hash-verify integrity, and maintain an unbroken chain of custody for both video and any social-media captures.
- Route through counsel and the SIU. Deliver findings to defense counsel and the carrier’s Special Investigation Unit for legal review, and let them coordinate use with the IME physician and claim strategy.
- Report objectively. State what was observed without embellishment or conclusions of law; the footage and the log carry the argument, and overreaching narration only hands the other side a credibility target.
How should carriers and defense counsel coordinate the work?
Sub-rosa surveillance rarely functions in isolation; it is one input into a coordinated defense. The most effective programs route investigative product through the carrier’s or TPA’s Special Investigation Unit and defense counsel, who decide how and when to use it. Surveillance shown to the IME physician can recalibrate a disability rating. Footage reserved for deposition can lock in sworn testimony that the video then contradicts—far more damaging than disclosing it early. Where the evidence indicates genuine fraud, counsel and the SIU determine whether to refer the matter to a state insurance fraud bureau or the National Insurance Crime Bureau, recognizing that workers’ compensation fraud is a felony in most states.
Discipline about proportionality matters here too. Surveillance is a targeted response to articulable red flags, not a default applied to every claim; indiscriminate monitoring wastes budget and invites bad-faith and privacy exposure. The carrier that treats investigators as an extension of its legal and SIU strategy—briefed on the file, aimed at specific representations, and held to forensic documentation standards—recovers far more than the carrier that orders “three days of surveillance” and hopes.
Representative scenario: the restriction that met the driveway
Consider a representative matter. A claimant asserted a disabling back injury with a strict lifting restriction and testified at deposition that they could no longer perform yard work or lift anything heavier than a gallon of milk. The file carried several red flags: a delayed, unwitnessed report and a neighbor’s offhand comment about a landscaping side business. An initial activity check and a review of public social-media content revealed photos of recent hardscaping projects. Surveillance was timed to a weekend before the scheduled IME. Over three consecutive days, investigators recorded—continuously, from the public street, with no audio and no trespass—the claimant repeatedly lifting and carrying paving stones, operating a compactor, and loading a truck. The native video was hash-verified and logged; the social-media captures were preserved with metadata. Shown the footage, the IME physician revised the assessment, and the recorded activity directly contradicted the deposition testimony. The claim was resolved on that record. This is an illustrative scenario, not a named client or a claimed outcome, but it captures the core lesson: lawful method and forensic documentation are what convert observed activity into evidence that ends a case rather than prolongs it.
Honeybadger Solutions supports carriers, third-party administrators, self-insured employers, and defense counsel across every Arizona venue and nationwide—coordinated from our Casa Grande, Phoenix, and Oro Valley offices—building investigations that stay lawful and admissible from the first frame.
Frequently asked questions
Is it legal to conduct surveillance on a workers’ comp claimant?
Yes, when it is done lawfully. A licensed investigator may observe and video-record a claimant’s activities that are visible from a public vantage point—a street, sidewalk, or other place the investigator is legally entitled to be. What is prohibited is trespassing onto private property, filming into a home or a fenced private area where privacy is expected, recording private audio in violation of wiretap laws, harassment or stalking, and impersonating officials. Rules vary by state, so licensing and jurisdiction should be confirmed before any surveillance begins.
Can social media posts be used as evidence in a workers’ comp case?
Often, yes—if collected properly. Publicly visible posts showing activity inconsistent with claimed restrictions can be strong corroborating evidence. Investigators must access only public content; creating fake accounts to breach privacy settings or accessing password-protected material can violate anti-hacking and stored-communications laws. To be admissible, the content should be preserved forensically with full-page and metadata capture, timestamps, source URLs, and hash verification, since a bare screenshot is easily challenged as undated or fabricated and posts are frequently deleted once litigation intensifies.
When is the best time to deploy surveillance in a claim?
Surveillance is most valuable when it is aimed at documented representations and timed to a milestone. The highest-yield windows are shortly before an Independent Medical Examination—so current footage can inform the physician—and around a deposition, where recorded activity can be contrasted with sworn testimony. Weekends and consecutive-day observation tend to capture more activity than isolated sessions. Activity checks and open-source intelligence should scout patterns first, so full surveillance hours are spent where they are likeliest to be productive.
What makes surveillance video admissible in court?
Two things: lawful acquisition and proper foundation. Footage obtained through trespass, illegal audio recording, or harassment can be excluded and expose the investigator to liability. Beyond legality, the video must be authenticated as a fair and accurate depiction, recorded continuously without deceptive editing, logged contemporaneously, and preserved in native format with an unbroken, ideally hash-verified chain of custody. The investigator must be able to testify to the equipment, vantage point, and method—so the material survives a motion to exclude and cross-examination.
About Honeybadger Solutions
Honeybadger Solutions is an Arizona-licensed security and investigations firm delivering full-spectrum investigations, digital forensics, and cybersecurity to carriers, third-party administrators, self-insured employers, general counsel, and defense firms nationwide and internationally. Our forensics, cybersecurity, financial-investigations, and background-intelligence capabilities are in-house and remote-by-design, conducted under recognized methodologies with hash-verified acquisitions, continuous chain of custody, and court-ready reporting. We operate three Arizona offices—Casa Grande (headquarters), Phoenix, and Oro Valley—and support engagements across every Arizona venue, all U.S. jurisdictions, and abroad.
Facing a questionable workers’ compensation claim and need surveillance that will hold up? Call 602-725-2818 to brief an investigations lead and scope a lawful, admissible approach with your SIU and defense counsel. Confidential. Defensible. Nationwide.
This article is general information, not legal advice; laws vary by state and change over time—confirm specifics with qualified counsel. Authoritative references: National Insurance Crime Bureau (NICB) and Coalition Against Insurance Fraud.