Which most likely indicates that a business email compromise attack has occurred?

When writing or reviewing a SAR/STR, it is important to ensure that the narrative is kept to the point;

easy to read; and addresses the who, what, when, where, why, and how. This is because the

narrative is the most crucial part of the SAR/STR, as it provides a clear and concise summary of the

suspicious activity or transaction that triggered the report. The narrative should include all the

relevant information that would help law enforcement or regulators to understand the nature and

context of the activity or transaction, such as123:

The who: The names, addresses, account numbers, and other identifying information of the parties

involved in the activity or transaction, such as customers, beneficiaries, intermediaries, or third

parties.

The what: The type, amount, frequency, and purpose of the activity or transaction, such as cash

deposits, wire transfers, check payments, or purchases of goods or services.

The when: The date, time, and duration of the activity or transaction, and whether it was a one-time

occurrence or part of a pattern or trend.

The where: The location or channel of the activity or transaction, such as branches, ATMs, online

platforms, or mobile applications.

The why: The reason or rationale for the activity or transaction, and why it was considered suspicious

or unusual based on the customer’s profile, behavior, or expected activity.

The how: The method or mechanism of the activity or transaction, such as cash, check, debit card,

credit card, cryptocurrency, or prepaid card.

Reference:

How to write the perfect “Suspicious Activity Reports” (SAR)? | i-AML

Writing for Prosecution: Best Practices For Composing SAR Narratives That Assist Prosecutors |

ACAMS

SAR Writing Examples and Proper Formatting: Write for Your Reader - Alessa