I have been struggling whether the bank's objective is to "arrest" or "collect" when we take a loss. For instance, we had a case where atm withdrawals were conducted on a single owner deceased customer's acct (customer died at age 55) before and after she passed. The same person who made the atm withdrawals before and after date of death is the same. The daughter of the decedent knows about the withdrawals when questioned and said that the money was used for funeral expenses. However, she refused to identify the person in the photos and was unresponsive to future requests to contact the bank. We incurred a loss of $1500 because we had to return the SSA benefits payments which overdrew the account. When I looked at the card history, there were no PIN resets, retry or errors and no reissued card. I suspect that the deceased shared her information with her family member based on the card history and daughter's knowledge about the ATM withdrawals. However, I was told that because we only know the first name of the individual (identified by a branch person) and since we took a loss, I need to file a police report and a SAR for ID Theft. I disagreed as my intentions were to "collect" than "arrest". The loss didn't meet the $5k/$25k threshold to do a SAR. And, the objective of filing a police report was more to collect than arrest based on the card activity and known use of funds. Thus, I proposed to send a certified letter to representative of deceased, explain the return of the SSA payments is required and does not belong to the deceased and that money is owed to us. Indicate that we have knowledge of a person named XXX withdrawing from the ATMs during 2/8/12 and 2/9/12 and that we understand the funds were used for funeral expenses. Include a statement that repayment should be made by X date. Otherwise, we may proceed in filing a police report for identity theft on the deceased customer. Any thoughts on this approach vs. filing a police report first? Thanks!