How one insurance carrier spotted a fraud attack in progress and stopped it before it scaled