One of our customers was duped by an on-line scam, resulting in a counterfeit check that exceeded $5K. We have an e-mail trail of the scam. I started putting the e-mail suspects name as the suspect rather than our customer, correct? I'll then detail what happened in the narrative.

Whatever you do, do NOT list your depositor as a suspect unless you believe he or she is complicit in the scam. A SAR suspect's name ends up in the Mother of All Databases, conceivably forever.

If you don't know who the suspect is (if you believe any info in the scam emails, I've got swampland for sale), list the suspect as "unknown." Then provide as much information as you can in the narrative.

That's how I would handle it. Even though I'm sure the suspect name is an alias, it's all you can do. Don't you just love those on-line scams? Like you have nothing else to do with your day! Unfortunately customers keep falling prey to them.

since the suspect is technically "unknown" - you only have to file a SAR if the amounts are over $25,000.

But we have a persons name in the e-mail trail, albiet probably an alias. Wouldn't that warrant we fill out at least that. Plus he gave an employer, again, not real but we still have a paper trail of info.

There's nothing to prevent you from filing, PQ, even if the dollar amount were $50. I encourage ID Theft and fraudulent check filings especially if there is a pattern that you haven't seen before.

However, the $25K threshold for filing when you don't have a suspect can provide you an "out" if you decide not to file.

Wouldn't this fall under the fourth requirement of SAR reporting?

Transactions conducted or attempted by, at, or through the financial institution (or an affiliate) and aggregating $5,000 or more, if the institution or affiliate knows, suspects, or has reason to suspect that the transaction:
* May involve potential money laundering or other illegal activity (e.g. terrorism financing).

Thanks John. So.....apparently I'm having a slow week, I would like to file but am not sure if I should put the most likely ficticious name since we have it and the place of employment (only 2 pieces other than his e-mail) that we have.

From SAR Activity Review #11

Additionally, the names (such as the payee name) that appear on such checks or other monetary instruments typically are phony and do not indicate real suspects; however, if a Suspicious Activity Report is completed, it is recommended that the payee name be included in the Suspect/Subject field of the Form.

This would also apply to originators of e-mails. Anything to help establish a pattern of multiple uses of the same name.


From SAR Activity Review #6

With regard to identity theft, financial institutions should keep in mind that the victim’s name should not go on the first page of the SAR under the field “suspect.” If there is no identifiable suspect, that field should state “unknown.” The victim’s name should be stated in the “Narrative” section of the form.

Although the excerpt from SAR Activity Review #6 concerns identity theft, it should also be applied to other schemes where the customer appears to be a victim. Believe it or not, sometimes funds can be recovered for the victim. It does not happen often, but it does happen, and by including the victim's name in the SAR narrative, you help law enforcement identify the victims in case they are willing to testify and for the purpose of returning any funds that may be recovered.

http://www.fincen.gov/sarreviewissue7.pdf

If a monetary loss has not been incurred from an advance fee fraud scheme and there are no other indicators of illegal activity warranting the filing of a Suspicious Activity Report, a financial institution should not file a Suspicious Activity Report and no further action is necessary.

Good catch. However, if a fraudulent check has been deposited, you have illegal activity warranting a SAR. Then, you have to determine whether the depositor is an "innocent" victim or a willing participant. If the transaction was attempted, but never completed, that is a different story. As I mentioned in another post some time ago, we have had a few customers go to extreme efforts to deposit the phony checks, even after they had been advised they are phony. That is when we began to wonder if they were "innocent" victims. If a phony item is deposited, there is always the potential for loss.

The customer is not at fault, that much we know. Victim of a scam. I filed it anyway with the information that we had. Thanks everyone for your help.