Ghost broking: how fake agents exploit insurance quote APIs
How the ghost broker business model works
A ghost broker advertises cheap insurance on social media, collects the driver's details and payment, then buys a real policy, often with falsified details to lower the premium, or forges the documents outright. The driver gets a policy number that looks valid until a claim or a traffic stop reveals it is worthless. The broker keeps the difference between what the driver paid and what the real policy cost, if one was bought at all.
The quote API is what makes this scalable. Instead of manually requesting quotes, the operation scripts thousands of quote calls across carriers, varying the risk details to find the cheapest bindable premium for each victim profile. The API was built for legitimate agent workflows; the ghost broker treats it as a pricing oracle.
The harvesting signature in your API logs
Legitimate agents quote the customers in front of them: a handful of quotes per hour, with bind rates that reflect real sales work. Harvesting looks different. Quote volume spikes from a single credential far beyond any human agent's capacity. The quote-to-bind ratio collapses, because the quotes are not for selling, they are for pricing intelligence. And the input details vary systematically, the mark of an optimization loop rather than a customer conversation.
The credential itself is often legitimate, which is what makes this hard. Ghost brokers buy or rent real agent appointments, or they compromise an agency's login. The API sees a valid key doing invalid things. Detection has to be behavioral, not credential-based.
Rate discipline that does not punish real agents
The fix starts with quotas that reflect human workflows. A real agent requests dozens of quotes a day, not thousands. Tiered rate limits, generous for normal use and hard-capped beyond it, stop harvesting without touching legitimate business. Add velocity alerts on the quote-to-bind ratio per credential, and route anomalies to review before the credential's next thousand calls.
Watermarking adds attribution. Embed invisible identifiers in quote documents and bind confirmations so that a forged policy presented at a claim can be traced to the quote that sourced it. When investigators can connect the fake policy to the harvesting credential, the operation loses its anonymity, which is its main protection.
Working with the victims, not just the logs
The drivers who bought ghost-brokered policies are victims, and they are also your best detection network. A simple verification flow, enter a policy number on the carrier site to confirm it is real, turns every suspicious driver into a report. Promote it at the point of sale and in claim communications, because the moment of doubt is when the driver will actually check.
Share the harvesting signatures with other carriers. Ghost brokers multi-source: the operation hitting your quote API is hitting three others with the same credential-rental model. Industry sharing turns isolated anomalies into a visible operation, and a visible operation is one law enforcement can act on.