Is any else confused by the vague guidance FinCEN issued regarding BSA Reporting on Cyber-Related Crime? We are scratching our heads trying to decide if an event is reportable.

Let's say fraudster creates an email address to masquerade as our customer. Fraudster emails loan officer - "Per the wire instructions below, please wire $120,000 to the Bank of India." No account number, no reason why. Loan officer instantly recognizes the email is fake and calls the customer to verify. Customers confirms he did not write the email, nor is it his email address.

Is this a reportable cyber-related incident? No bank account was compromised. The loan officer never acknowledged fraudster. We have a third party name, a foreign financial institution, account number, etc. We barely have any suspect information. The only suspect profile information we could report is an email address and the wiring instructions.

Thoughts?

This is absolutely reportable. FinCEN even developed a special acronym for you to include in your SAR. Your SAR filing requirements are based on suspicious transactions that are completed or attempted through a financial institution so whether or not the wire was sent or a loss sustained is not relevant. Also, if needed enlist the help of IT to identify an IP address from whence the fraudulent email originated as this should also be included in the SAR. Law enforcement can use this information to connect the dots to other attempted or successful emails.

See the FinCEN Guidance on these here:

https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2016-a003

Prior thread

Accepting that a decision not to file a SAR must be documented, scenarios like yours are going to be drawn to the attention of third party reviewers. You simply cannot say "We didn't file the SAR because we knew it was worthless."

Your perp lacks some basic skills. Your SAR's only contribution to the realities of law enforcement will be a bogus e-mail address. If you can enhance it with an ISP, its value increases, but not to the point where it would be measurable.

Thank you for the feedback! Greatly appreciated.

Additional guidance was released by FinCEN in October 2016 that include scenarios that seem to mirror yours. Please refer to:
https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2016-a005

If the wire was sent, are you including the name of the fake recipient as a suspect in the SAR?

If I am filing and that is all the information I have I would include it but might mention in the narrative that it may be a fake name depending on the situation and my knowledge of the facts.