Reasonable Suspicion: What BC Employers Need Before Hiring a Private Investigator

Last Updated: April 2026

Reasonable Suspicion: What BC Employers Need Before Hiring a Private Investigator

Reasonable suspicion is the legal and practical threshold that must be met before an employer in British Columbia can justifiably commission covert surveillance or other investigation methods that the Office of the Information and Privacy Commissioner (OIPC) may consider intrusive, in connection with a workers’ compensation claim. It means having specific, objective, documentable evidence that a worker’s reported functional limitations are inconsistent with their actual behavior, not a hunch, not a gut feeling, and not a general distrust of the employee.

Not every investigative step requires the same threshold. Less intrusive preliminary measures, such as reviewing a worker’s publicly available social media, requesting updated medical documentation, or contacting WorkSafeBC, do not require the same level of justification as deploying a private investigator for covert surveillance. These preliminary steps are in fact recommended as early measures that may either resolve the concern on their own or help establish the documented basis needed before more intrusive methods are warranted.

The reasonable suspicion threshold exists because of two intersecting legal frameworks. Under BC’s Personal Information Protection Act (PIPA), surveillance must be “reasonable for an investigation.” Under the Workers Compensation Act (Sections 47–50), the reversed burden of proof means the employer must be able to demonstrate that any investigation was based on independent evidence of functional inconsistency, not on the fact that the worker filed a claim.

Getting this right before the investigation begins is not optional. It is the foundation of the employer’s legal defense if a prohibited action complaint is filed. This page explains what qualifies as reasonable suspicion, what does not, how to document it properly, and what steps to take before commissioning covert surveillance.

In This Article

• What Qualifies as Reasonable Suspicion
• What Does NOT Qualify
• The “But-For” Test: Your Internal Self-Assessment
• Less Intrusive Alternatives: What You Must Consider First
• Separating Your Safety Investigation from Your Injury Claim Investigation
• How to Document Reasonable Suspicion
• The Timeline That Matters
• What to Have Ready Before Contacting a PI
• Maintaining Employment Neutrality
• FAQ: Reasonable Suspicion for WCB Investigations

What Qualifies as Reasonable Suspicion

Reasonable suspicion requires a specific, documentable conflict between what a worker says they can do (their reported functional limitations) and what the evidence suggests they are actually doing. The evidence must be objective, something that can be written down with dates, sources, and specific details, and it must point to a particular inconsistency, not a vague concern.

The following types of evidence generally meet the reasonable suspicion threshold:

Direct Observation

You or a supervisor personally witnessed the worker performing physical activity that contradicts their documented medical restrictions. For example, a worker whose physician has stated they cannot lift more than 10 pounds is observed by a supervisor loading heavy equipment into a truck at a neighbourhood job site. The observation should be documented immediately with the date, time, location, specific activity observed, and the name of the person who witnessed it.

Credible Third-Party Reports

A co-worker, neighbor, customer, or other credible source reports that the worker is engaging in activities inconsistent with their claimed limitations. The report should be documented with the date it was received, the identity of the source (or a clear description of why the source is credible if they wish to remain anonymous), and the specific activity described. A co-worker saying “I saw him playing baseball on Saturday” is more actionable when documented as “On March 15, 2026, employee John Smith reported that he observed the claimant playing in a recreational baseball league at Central Park on Saturday, March 13, at approximately 2:00 PM.”

A common concern is whether the reporting coworker’s identity will be disclosed to the claimant. It does not need to be. The employer should record the coworker’s identity and the details of their observation in the internal reasonable suspicion file, but nothing in PIPA, the Workers Compensation Act, or the prohibited action framework requires the employer to reveal who provided the information. If the file proceeds to a WCAT hearing, the employer must be able to demonstrate that the investigation was based on specific, credible evidence, which means describing what was reported, when, and why the source was considered credible, but the source’s name is not something the claimant is automatically entitled to.

When the investigation produces independent evidence through surveillance, OSINT, or other methods, that evidence stands on its own and the coworker’s report becomes the documented justification for initiating the investigation, not the evidence presented against the claimant. Employers should assure any coworker who reports a concern that their identity will remain confidential, and should limit knowledge of the report to the person authorizing the investigation and, if applicable, legal counsel.

Social Media Evidence

Publicly available social media posts showing the worker engaged in physical activity that directly contradicts their reported restrictions. This is one of the strongest forms of reasonable suspicion because it is self-documented by the worker, timestamped by the platform, and available for immediate screenshot preservation. A worker who claims they cannot stand for more than 30 minutes posting a video of themselves hiking for three hours provides clear, documentable evidence of inconsistency.

If you identify a social media contradiction, screenshot it immediately with visible timestamps, URLs, and the platform name. Social media posts can be deleted at any time, and the screenshot becomes the preserved evidence. Do not interact with the post (like, comment, share) or alert the worker in any way that you have seen it.

Medical Inconsistency

The worker’s reported symptoms are physically inconsistent with the objective medical evidence. For example, the worker reports inability to lift 5 pounds due to a shoulder injury, but diagnostic imaging shows no structural damage or pathology that would explain that level of restriction. Alternatively, the worker’s recovery timeline significantly exceeds the normal parameters for the diagnosed condition without a documented medical explanation for the delay.

Medical inconsistency is a valid basis for suspicion, but it requires careful handling. Employers are generally entitled to functional information (what the worker can and cannot do) but not to full diagnostic history. If you believe the medical documentation does not support the claimed severity, you may request a more detailed assessment or a Functional Capacity Evaluation (FCE) before moving to surveillance.

Suspicious Timing Patterns

Timing patterns that suggest the injury claim may not be genuine. The most common pattern, sometimes called the “vacation trap,” is where a worker’s request for specific dates off was denied, and a disabling injury was subsequently reported for those exact dates. Other suspicious timing includes injuries reported immediately before a scheduled layoff, immediately after a performance-related disciplinary meeting, or at the start of a seasonal shutdown when the worker would otherwise be unemployed.

Communication Red Flags

The worker consistently misses physiotherapy or specialist appointments without valid reason, refuses independent medical examinations, becomes unreachable during expected recovery hours, or provides evasive or contradictory answers when asked generally about their recovery. Any single communication red flag may have an innocent explanation, but a pattern of avoidance combined with other indicators strengthens the reasonable suspicion basis.

For a comprehensive reference on red flag indicators organized by category, see our Red Flags That May Indicate a Fraudulent WCB Claim knowledge page.

What Does NOT Qualify as Reasonable Suspicion

Understanding what does not constitute reasonable suspicion is just as important as understanding what does. The following are common reasons employers want to investigate a claim, but none of them meet the threshold on their own:

• “The claim is expensive and will increase our premiums.” Claim cost is a financial concern for the employer, but it is not evidence that the claim is fraudulent. Many legitimate claims are expensive.
• “The worker was a poor performer before the injury.” Past performance issues do not make a current injury claim fraudulent. Using performance history as a basis for investigation creates a clear retaliation argument.
• “The injury is soft tissue, so it must be hard to verify.” Soft tissue injuries are legitimate medical conditions. The difficulty of objective verification does not make the claim suspicious.
• “I just have a feeling something isn’t right.” A gut instinct is not documentable evidence. It cannot be presented to WorkSafeBC, WCAT, or the OIPC as justification for an investigation.
• “The worker has filed WCB claims before.” Previous claims do not make a current claim fraudulent unless there is a specific, documented pattern combined with other indicators relevant to this claim. Workers in physically demanding occupations may legitimately file multiple claims over a career.
• “The worker hired a lawyer right away.” Retaining legal representation is the worker’s right under the Act. It is not evidence of fraud, and using it as a basis for investigation would directly contradict the protections in Section 48.
• “Nobody saw the injury happen.” Unwitnessed injuries are common, particularly in workplaces where employees work independently. The absence of a witness, without additional indicators, does not establish reasonable suspicion.

If the reasons on this list are the only basis for your concern, you are not yet at the threshold for commissioning a surveillance investigation. If you are unsure whether your evidence meets the reasonable suspicion standard, consult with independent legal counsel before proceeding. A professional investigation firm will also assess this during intake and may advise you if the threshold does not appear to be met, but the legal determination of whether an investigation is defensible under the Workers Compensation Act and PIPA is a question for your lawyer, not an investigator.

The “But-For” Test: Your Internal Self-Assessment

Before you proceed with any investigation, ask yourself this question and answer it honestly:

“If this employee had NOT filed a WCB claim, would I still be investigating them based on the evidence I have?”

If the answer is no, if the only reason you want to investigate is that the worker filed a claim, then you do not have a defensible basis for an investigation, and proceeding creates serious legal exposure under the Workers Compensation Act.

If the answer is yes, if the evidence you have would have triggered an investigation regardless of whether a claim was filed, then document that reasoning and the specific evidence supporting it. This documented self-assessment becomes the foundation of your defense if a prohibited action complaint is filed. The key is honesty: this test only protects you if the answer is genuinely yes, supported by evidence, not if it is constructed after the fact to justify a decision already made.

Less Intrusive Alternatives: What You Must Consider First

Under PIPA and OIPC guidance, surveillance should be a “last resort” after less privacy-invasive alternatives have been explored. You are not required to exhaust every alternative before engaging a private investigator for surveillance, but you must be able to explain why less intrusive options were insufficient, and that explanation must be documented before the investigation begins.

The following escalation ladder moves from least to most intrusive. Consider each step and document your reasoning for skipping any step you do not take:

Step 1: Open-Source Intelligence (OSINT) and Social Media Review

Reviewing the worker’s publicly available social media profiles and online presence is the least intrusive starting point. Public information that the worker has voluntarily shared online, such as social media posts, marketplace listings, event check-ins, or business registrations, does not require the same level of justification as covert surveillance, because the individual chose to make this information publicly accessible.

If the worker claiming disability has posted public videos of themselves hiking, playing sports, or performing physical labor, that content alone may establish the reasonable suspicion needed for more formal investigation, or in some cases may be sufficient on its own to submit to WorkSafeBC as new information relevant to the claim.

While an employer can technically conduct this review themselves, there are practical reasons to consider engaging a licensed private investigator for even this initial step:

• Platform association risks. When an HR manager or supervisor views a claimant’s LinkedIn, Instagram, or Facebook profile from their personal or work account, the claimant may see them in “People who viewed your profile,” suggested connections, or “People you may know” algorithms. This can alert the claimant that they are being monitored, leading to evidence destruction, such as deleted posts, locked-down privacy settings, or modified behavior, before any formal investigation begins.
• Evidentiary quality and chain of custody. A professional OSINT investigator uses dedicated research tools and archiving methods that produce documentation with consistent timestamps, URLs, and preservation standards. An employer taking screenshots on their personal phone or work laptop produces evidence with no standardized chain of custody, which may face more scrutiny if the file proceeds to a WCAT hearing or litigation.
• PIPA proportionality. When an employer scrolls through a claimant’s entire social media history, they inevitably encounter personal information unrelated to the claim, such as family photos, political views, medical appointments, relationships. Under PIPA Section 14, the use of personal information must be for purposes a reasonable person would consider appropriate. A professional investigator reviews the same content but delivers only findings relevant to the reported limitations, creating a natural filter that demonstrates proportionate collection and reduces the employer’s exposure to information they should not have.
• Independent credibility. Evidence gathered and documented by a licensed, independent third party carries more weight than evidence gathered by the employer who has a financial interest in the outcome of the claim. An employer presenting their own screenshots may face arguments of cherry-picking or taking content out of context.

If you do conduct an initial review yourself and identify a social media contradiction, screenshot it immediately with visible timestamps, URLs, and the platform name. Social media posts can be deleted at any time, and the screenshot becomes the preserved evidence. Do not interact with the post (like, comment, share) or alert the worker in any way that you have seen it. Whether or not you find relevant content, document that the review was conducted, the date it was conducted, and what the results were.

Step 2: Direct Inquiry

Where appropriate, ask the worker to clarify their current functional abilities. This can be done through a written questionnaire or a structured conversation. However, if you believe direct inquiry would compromise the evidence, for example, if the worker would modify their behavior, delete social media posts, or shut down a side business once alerted, document why this step was skipped. Common justifications include risk of evidence destruction, prior inquiries that yielded evasive or contradictory responses, or the worker being unreachable.

Step 3: Medical Clarification and Functional Assessment

Request updated or more detailed medical information from the treating physician. Employers are generally entitled to functional information (what the worker can and cannot do in relation to their job duties) but not to full diagnostic history.

A practical first step is WorkSafeBC’s Functional Abilities Assessment (FAA) template. This is a free form that the employer gives to the worker, who takes it to their healthcare provider. The provider completes the assessment, documenting the worker’s current functional abilities such as lifting, standing, sitting, and bending capacities. The completed form is returned to the employer and can be used to identify suitable modified work or to clarify whether the reported limitations are supported by a current clinical assessment. If a healthcare provider charges a fee for completing the FAA, the employer is responsible for that cost. WorkSafeBC does not require employers to use the FAA, but if one is completed, it should be submitted to WorkSafeBC as well.

If the FAA does not resolve the inconsistency, or if a more comprehensive evaluation is needed, the employer can request a Functional Capacity Evaluation (FCE) through the WorkSafeBC Case Manager assigned to the claim. An FCE is a standardized, multi-hour assessment of the worker’s physical abilities conducted by a qualified professional such as a registered physiotherapist or occupational therapist. The Case Manager must agree that an FCE is medically appropriate and necessary for the claim, and if approved, WorkSafeBC covers the cost. Alternatively, an employer can commission a private FCE independently, though the worker cannot generally be compelled to attend a private FCE for a WorkSafeBC claim unless it is a condition of a collective agreement or employment contract. If the worker refuses, the employer may need to request the evaluation through the Case Manager.

If you have already obtained medical documentation or a functional assessment and it does not resolve the inconsistency, document that this step was taken and why it was insufficient.

Step 4: The Duty to Cooperate

Effective January 1, 2024, both employers and workers in British Columbia have a reciprocal Duty to Cooperate under Division 3.1 of the Workers Compensation Act. This duty requires both parties to cooperate with each other and with WorkSafeBC to facilitate the worker’s safe and timely return to work. Employers must contact the worker as soon as practicable after the injury, maintain communication, and identify suitable work. Workers must do the same and must not unreasonably refuse suitable work.

If a worker fails to cooperate in the return-to-work process, WorkSafeBC may reduce or suspend their compensation payments. Employers who fail to cooperate may face administrative penalties. For employers with 20 or more workers, a separate Duty to Maintain Employment also applies, requiring the employer to offer pre-injury work, comparable work, or suitable work, and to accommodate the worker to the point of undue hardship.

From an investigation perspective, the Duty to Cooperate is relevant because an employer’s documented cooperation efforts, including communication records, offers of suitable work, and requests for functional information, strengthen the employer’s overall position if a prohibited action complaint is filed. Conversely, a worker’s documented failure to cooperate or refusal to participate in the return-to-work process may be relevant context when assessing whether further investigation is warranted. The interaction between the Duty to Cooperate and the prohibited action framework is nuanced, and employers should consult independent legal counsel for guidance on how these duties apply to their specific situation.

Step 5: WorkSafeBC Fraud Reporting

Contact WorkSafeBC’s fraud tip line to report your concerns. As of April 2026, the Field Investigations Division has been disbanded and tips are no longer being actioned by trained investigators. However, documenting an unsuccessful attempt to use the government channel significantly strengthens the reasonableness of commissioning a private investigation. Record the date, method of contact, person spoken with (if any), and the outcome.

Step 6: Targeted Professional Surveillance

Deploy a licensed private investigator to conduct limited, proportionate observation in public spaces during specific time windows when the suspected activity is most likely to occur. This is the most intrusive option and should be supported by documented reasonable suspicion from one or more of the preceding steps. The scope of surveillance must be proportionate to the evidence. If you suspect the worker is playing in a baseball league on Tuesday evenings, surveilling their home 24/7 is disproportionate and will be harder to defend under PIPA.

Separating Your Safety Investigation from Your Injury Claim Investigation

Under BC’s Occupational Health and Safety Regulation, employers are legally required to investigate any workplace incident that caused or had the potential to cause serious injury. This is a mandatory safety investigation focused on understanding what happened, why it happened, and how to prevent recurrence.

An injury claim investigation, where you are examining whether the worker is misrepresenting the nature or severity of their injury, is a separate, discretionary activity. These two investigations must be clearly separated in your documentation, your personnel, and your timing.

If a worker can show that the same people who conducted the mandatory safety investigation also initiated personal surveillance of them, it becomes much easier to argue that the investigation was retaliatory and that the employer used the safety investigation as a pretext to target the worker personally. Use different personnel for each investigation where possible, maintain separate documentation, and ensure the claim investigation is triggered by evidence of inconsistency, not by the safety investigation process.

How to Document Reasonable Suspicion

Documentation must be created at or near the time the evidence was identified, not reconstructed days or weeks later. A note written the same day you received a co-worker’s report is far more credible than one reconstructed from memory a month later.

For every piece of evidence that contributes to your reasonable suspicion, document the following:

• What was observed, reported, or discovered. Describe the specific activity or information in factual, objective terms.
• When it was identified. The exact date you became aware of the information. This is critical because the timeline must show that you learned of the evidence before you decided to investigate, not the other way around.
• Who provided the information. The identity or description of the source and their credibility.
• What medical restriction it conflicts with. Identify the specific reported limitation from the WCB claim or physician documentation that the evidence appears to contradict.
• How the conflict is specific, not general. “He seems fine” is not a documented conflict. “He was observed carrying a 50-pound bag of gravel to his truck, despite a restriction of no lifting over 10 pounds” is.

Store this documentation separately from the worker’s regular personnel file. It should be accessible only to the person authorizing the investigation and, if applicable, your legal counsel.

The Timeline That Matters

In a prohibited action complaint, the timeline is one of the first things a WorkSafeBC adjudicator or WCAT Vice Chair will examine. The critical question is whether the investigation was triggered by the discovery of evidence or by the filing of the claim.

Three dates matter most:

• Date the WCB claim was filed.
• Date the evidentiary trigger was identified (when you first learned of the specific evidence that raised your suspicion).
• Date the investigation was requested.

The defensible sequence is: claim filed → evidence discovered (days, weeks, or months later) → investigation requested based on the evidence. If the investigation request date is closer to the claim filing date than to the evidence discovery date, the file is vulnerable to the argument that the investigation was a reaction to the claim, not a response to independent evidence.

If you discover the evidence at the same time the claim is filed, or very shortly after, document this carefully. Explain what the evidence is, how it came to your attention independently of the claim process, and why it constitutes a specific conflict with the reported limitations. The goal is to demonstrate a connection between the evidence and the investigation, not between the claim and the investigation.

What to Have Ready Before Contacting a Private Investigator

When you contact a private investigation firm about a WCB claim file, having the following information prepared will accelerate the intake process and ensure your file meets the reasonable suspicion threshold from day one:

• The evidentiary trigger: A written description of the specific event, observation, or report that prompted your suspicion, including the date it occurred and who was involved.
• The worker’s medical restrictions: The documented functional limitations from the WCB claim, physician documentation, or a completed Functional Abilities Assessment (for example, “cannot lift more than 10 lbs,” “cannot stand for more than 30 minutes”).
• The specific conflict: A clear explanation of how the trigger contradicts the medical restrictions.
• Less intrusive steps taken: Documentation of what alternatives you considered or attempted (OSINT review, direct inquiry, FAA or FCE, medical clarification, WorkSafeBC contact) and why they were insufficient.
• Schedule and location intelligence: Any information about the worker’s daily patterns, addresses, vehicles, or the specific times and locations where the suspected activity is most likely to occur.
• Employment context: Whether the worker is unionized, whether there are any active grievances or labour disputes, and whether the worker is currently subject to any unrelated disciplinary process.
• FID contact attempt: Whether you attempted to report to WorkSafeBC’s fraud tip line and what the outcome was.
• Authorized contact: The name and contact information of the single person within your organization who has authority to authorize the investigation and manage the relationship.

The more complete this information is at intake, the more efficiently and defensibly the investigation can be conducted. If you have not yet completed the OSINT or social media review step, a professional investigation firm can conduct this as a standalone service before determining whether surveillance is warranted.

Maintaining Employment Neutrality

From the moment a WCB claim is filed through the completion of any investigation, the employer must maintain the worker’s employment conditions exactly as they were. Any change, even one that seems minor, routine, or unrelated, can be used as evidence of a prohibited action.

During this period:

• Do not reduce the worker’s hours, wages, or benefits
• Do not change their duties, shift schedule, or work location unless mutually agreed for light-duty accommodation
• Do not issue any disciplinary action, verbal or written warning, or performance review that is not part of a pre-existing, documented schedule
• Do not discuss the investigation with co-workers, supervisors, or anyone who does not have a legitimate need to know
• Do not express scepticism, frustration, or disbelief about the claim to anyone in the workplace
• Do not contact the worker more frequently than normal or make unexpected check-in calls
• Do not assign tasks designed to test the worker’s physical abilities, as that is the role of a qualified medical professional, not the employer

Knowledge of the investigation should be limited to the person who authorized it, your legal counsel (if retained), and the investigation firm. The worker’s direct supervisor should not be informed unless absolutely necessary, and even then should receive only the minimum information needed. Supervisors who know about an investigation may inadvertently change their behavior toward the worker, creating evidence of retaliation.

Frequently Asked Questions

Related Knowledge Pages

• Injury Claim Investigations in BC Guide (Pillar Page)
• Prohibited Action Complaints in BC: What Every Employer Must Know
• PIPA and Employer Surveillance: Privacy Law for WCB Investigations in BC
• Red Flags That May Indicate a Fraudulent WCB Claim
• The WorkSafeBC FID Disbanding: What It Means for BC Employers in 2026
• What Employers Should Do After Receiving Investigation Results

References and Regulatory Resources

• Workers Compensation Act – Division 6: Worker Protection (Sections 47–50)
• Workers Compensation Act – Full Text (including Division 3.1: Return to Work)
• BC Personal Information Protection Act (PIPA)
• Office of the Information and Privacy Commissioner for BC (OIPC)
• WorkSafeBC – Functional Abilities Assessment Template for Employers
• WorkSafeBC – Duty to Cooperate and Duty to Maintain Employment
• WorkSafeBC – Report Suspected Fraud
• Province of BC – Employers’ Advisers Office (EAO)

Need Help Assessing Whether You Have Reasonable Suspicion?

If you are a BC employer who suspects a WCB claim may be inconsistent with the worker’s actual abilities but are unsure whether your evidence meets the threshold for a formal investigation, contact Shadow Investigations by phone at 604-657-4499 or through our confidential inquiry form below. We have been handling injury claim and fraud-related investigations throughout BC since 1990.

We will review the basis for your concerns during a free, confidential consultation and can advise on what investigative steps may be appropriate for your situation. If you have not yet conducted an OSINT review, we can perform this as a standalone service to help determine whether more formal investigation is warranted. If you are unsure whether your evidence meets the reasonable suspicion threshold under PIPA and the Workers Compensation Act, we recommend consulting with independent legal counsel before commissioning covert surveillance.

Contact Form for Investigation Inquiries

About the Author

Since 1993, Janet Helm has been a licensed private investigator in British Columbia, with a 30-year financial background in auditing, tax, and accounting. She co-manages Shadow Investigations Ltd., a professional agency in operation since 1990. A member of the Professional Investigator’s Association of BC (PIABC) since 1995, Janet served as its president, initiated the first private investigation course at Douglas College in 1998, and helped develop the Certified Canadian Professional Investigators designation. For her contributions, she received the Taras Hryb Education Builder’s Award. Janet also belongs to various investigator organizations such as the American Society of Industrial Security (ASIS), the World Association of Detectives (WAD), and the Association of Certified Fraud Examiners (ACFE), reflecting her commitment to ongoing education and staying abreast of her field.