Customer had a number of bill payments that appeared suspicious. There was not a sufficient balance in her account to cover the payments which totaled over $15,000. Her online banking was compromised with her cooperation to an individual out of the country.

The bank did not lose any money and the accounts are now closed. Do I need to file a SAR on this? I think she had to know this was wrong.

The bank did not lose any money and the accounts are now closed
Not material

As for the rest

https://www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_015.htm

You have suspected fraud with a suspect (bill pay recipient?) over and above your own customer and it totals to over $5K.

We would file.

Would the customer and the unknown individual both be subjects?

Based on the information you provided I would include both in the narrative.

That is up to your analysis of facts and circumstances. Sometimes we name our customer, sometimes we don't. If we don't, we name our customer in our narrative and say why we did not name him. Such as...our customer appears to be learning disabled and is not named as a suspect...etc.

Okay, thank you for your input!