Should we file a CTR for both withdrawing and depositing and should there be a SAR filed for the attempted scam?
Do you need to file a SAR? Technically, not right now. But the $25,000 threshold shouldn't be used as an excuse to dismiss suspicious activity. You're supposed to be using the extended 60 day deadline to try and identify a suspect.
If you leave this as is, a knowledgeable examiner would scrutinize the completeness of your investigation. If the customer was going to mail the cash; ask her - who was this addressed to? Who are you speaking with? Have a conversation with your customer and figure out all of the details. I can almost guarantee you that such a conversation will result in you having identified a suspect. And failing to have that talk borders on willful blindness.
Talk to your customer, identify the suspect, file the SAR.