Should a bank contact law enforcement regarding forgery or account takeover? Or should that be the customers responsbility?

Who took the loss? Usually that determines who LE will listen too.

If the dollar amount pulls a SAR trigger, the bank must file, regardless of whether its ox was gored or whether the bank contacts law enforcement directly.