Assess whether a SAR narrative is supportable today from BEC wire

Situation

A SAR narrative is sits with wire-desk escalation officer because an email that matches a known BEC lure almost exactly hit a P&C carrier's auto-body network. Evidence is BEC wire instruction-change email thread; write the Fraud Detection Credit and Identity Fraud option that extract can carry.

Decision

Wire-desk escalation officer in a P&C carrier's auto-body network must choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold using BEC wire instruction-change email thread after an email that matches a known BEC lure almost exactly.

Hypotheses to test

• An email that matches a known BEC lure almost exactly is noise around an already-controlled Credit and Identity Fraud process in a P&C carrier's auto-body network, given BEC wire instruction-change email thread.
• An email that matches a known BEC lure almost exactly is the event in BEC wire instruction-change email thread that forces Remove access or reverse the item for wire-desk escalation officer under Fraud Detection.
• BEC wire instruction-change email thread shows a one-file miss after an email that matches a known BEC lure almost exactly, not a Credit and Identity Fraud program failure.
• BEC wire instruction-change email thread cannot decide a SAR narrative is yet after an email that matches a known BEC lure almost exactly; hold is the only Fraud Detection close a P&C carrier's auto-body network can defend.

Analysis required

• Quantify loss if the hold is released before BEC wire instruction-change email thread is complete.
• Test a one-off dispute against the first edge of a scheme around a SAR narrative is.
• Check mule or round-trip markers in BEC wire instruction-change email thread.
• For this Fraud Detection Credit and Identity Fraud file, read BEC wire instruction-change email thread against an email that matches a known BEC lure almost exactly and write the one fact that would move a SAR narrative is for wire-desk escalation officer.

Recommendation

Choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold on this Fraud Detection / Credit and Identity Fraud packet (BEC wire instruction-change email thread after an email that matches a known BEC lure almost exactly). Lead with the Fraud Detection option BEC wire instruction-change email thread can support after an email that matches a known BEC lure almost exactly, then the two facts that force it, then the Monday action for wire-desk escalation officer in a P&C carrier's auto-body network.