I have a new scenario and not sure whose name will be listed in Part II of the Suspect Information and what to report as the type of suspicious activity.
One of our customers who uses our cash management product had their computer hacked. The hacker was able to gain access to our customers login information for their online services and processed some wire transactions from their account.
I originally thought this would be reported as computer intrusion but after reading some of the SAR Activity Reviews I realize that refers to the banks computers being accessed so I assume we file it for wire fraud?

My main question is who will be listed as the suspect? Normally it would be our customer but since they are the victim instead of the suspect, how would we complete that section?

By the way, we were able to retrieve most of the funds and have tracked the IP address and are attempting to get further information. Anyone have suggestions on how to find the owner of an IP address?

Any help is appreciated.

You have an unknown suspect - Part II will be blank and you check the "Suspect Information Unavailable" box.

you can run a "whois" search for the ip address (google is your friend)- but more likely than not the actual address you have isn't the one that the criminal was at- unless the person in question was incredibly stupid. Usually in that type of a situation they use a "proxy" to disguise their actual address- and the address you have would be that of the proxy rather than the acutal one used in the fraud, but by all means pursue it because stranger things have happened.

If the whois search turns up an ip address in the state, you can contact the provider listed (it will be the owner of the address) and see if they could help- but more often than not you'll need a subpoena. Good luck getting any cooperation if they're out of the country.

You also know who benefitted from this activity (beneficiaries of the fraudulent wires) and could provide their names as suspects and bank account information in the Narrative.

If you have a contact with your local SAR Task Force or FBI - they may be able to help you track it down.

Thanks for the input.