We reported a customer was a victim of BEC on 04/03/24. On 05/15/24, we received a large recovery.
Can I report the large recovery now or do I need to wait until 90 days has passed?
Do I report as continuing activity?
We had spoken to law enforcement prior to the initial filing, do I leave that information if I have not spoken to them since the initial filing?
#29 - Do I include the amount of the recovery?
#30 - Do I put the day we received the recovery?
#31 - Do I put the prior fraudulent total less the recovery?
#34 - Keep the reason as wire fraud?
For the narrative I plan to include:
This is an update to a SAR filed on 04/03/24.
On 05/15/24, we received a recovery of $X and the updated loss is $X.
Keep a summary of the total suspicious activity.
Does this sound correct? Am I missing anything?

A recovery is not continuing suspicious activity and you do not file another SAR to report a recovery. If you choose to advise law enforcement of the recovery, you will amend the original SAR to update the loss amount and then state in the first sentence of the amended narrative that the SAR is being amended due to the dollar amount of the recovery. Nothing else on the SAR in part II would change.

This was another option considered. Should the date range be changed?

No. The date range of the suspicious activity hasn't changed. Remember, a recovery is not part of the suspicious activity.