Marine insurance fraudster jailed for 7.5 years: when the logs tell the story

A former marine insurance claims handler has been sentenced to seven and a half years in prison by City of London Police for fraud ^[1]. The case turned on the insurer's ability to show what its claims handling system had done, and when.

The fraudster had used their position to create false claims, manipulate the approval process and divert payments. Investigators traced the activity through the insurer's logs. Those logs became the evidence.

It's the kind of case where a log is like a receipt: nobody looks at it until there's a dispute, and then it decides the outcome. The difference is that a receipt from a till is printed at the moment and can't be quietly changed afterwards. A digital log can be, unless someone has sealed it.

What the case shows

The fraud worked because the handler had legitimate access to the system. From the outside, the claims looked ordinary. It was the logs that revealed the pattern: approvals at unusual times, payments to accounts that didn't match the claim records, and edits made after normal review processes had closed.

Without those logs, proving what had happened would have been harder. With them, the case became a matter of tracing entries back to specific actions on specific days. The logs told the story.

That only works if the logs themselves can be trusted. A claims handler with system access could, in theory, have edited the logs to cover their tracks. In this case, the investigation was able to rely on the records. Not every organisation can say the same.

Logs you can trust

Insurers keep logs of claims, approvals, payments and changes. Those logs sit on systems the insurer controls, often accessible to people with administrator rights. That's fine until someone questions what the log says, or whether it has been changed since the event.

Under DORA, financial firms including insurers must protect log systems and log information against tampering, deletion and unauthorised access, and must detect failures in the logging process ^[2]. The rule has applied since 17 January 2025.

The technical standard doesn't say how to do it. Access controls and monitoring are the foundation. An independent record of what each log segment contained when it was written goes one step further, because a change shows up even when it's made by someone with the right access.

That's where a digital witness fits.

How it would work for claims logs

Here, the thing to seal is each log record as it is written: the claim reference, the handler, the approval decision, the amount and the payment instruction. Sealing takes a fingerprint of the record, not the record itself, so the content never leaves the insurer's systems.

You seal log segments at short intervals, for example every few minutes, through the REST API, the SDK or the MCP server. When an investigator, an auditor or a supervisor asks whether a log entry has changed since it was written, anyone you share the record with can check the fingerprint against the sealed one. If they match, the record is unchanged. Change a single character and they won't match.

A digital witness doesn't replace access control, monitoring or backups. It doesn't show that a claim was valid or that a payment was authorised. What it does is make it checkable that a log record is exactly what was written at the time, without anyone having to trust the people who keep the logs.

The content stays with you. The fingerprint is sealed with WitniumChain. The first 2,000 witnesses a month are free. Read the docs.

What this means for you

If you work with claims, payments or approvals in insurance or another financial sector, here are three questions worth asking:

1. Could we show an investigator or an auditor what our system logged on a given day, in a way that holds up when questioned?
2. Who in our organisation has the access rights to edit logs, and how would we know if they did?
3. Are our logs protected against tampering, deletion and unauthorised access, as DORA requires?

The third one is a compliance question. The first two are about trust: can you show that your records are what they say they are, without asking anyone to take your word for it?

In the City of London case, the logs were the evidence that made the conviction possible. The next time logs matter, they'll need to be just as solid.