Should we be filing SARs on all people that we discover have provided us with false SSNs if the transactions exceed $25,000 and we can't specifically identify a victim?

Here's our scenario:
Long-time customer who appears to be operating a one man construction business deposits over $10,000 which triggers a CTR. Bank gets an error back for SSN not matching person. We verify through the SSN that the person and the SSN don't match. His wife who is also on the account has a SSN that doesn't match. All the account activity appears ligitimate relative to a small construction business. He has had well in excess of $25,000 in transactions but nothing individually.

Do we file a SAR on this?

We had a similar situation. One of our customers had a DDA account, then applied for a line of credit. When he applied for the line of credit, the SSN was not a match. We use Netdective, we input the SSN on that system and it came back to a name of a person that is now deceased. We closed this customers account and filed a SAR even though it was under the reporting threshold.

If you determine that the SSN being used is valid, but does not match to the individual, you are dealing with a case of identity theft and it is illegal.

You may recall (last year or perhaps 2007) a case where about 1200 illegal aliens were picked up at a meat processing facility. That case originated when a lady filed a complaint that someone was using her deceased brother's SSN. She refused to give up and the result was the raid on that company.

The purpose of SARs is to provide information relative to illegal activity to law enforcement. Remember, you may be looking at a small piece to a much larger puzzle.