How to write a fraud investigation report a SAR can rely on

To write a fraud investigation report, put the decision first, then tell what happened in time order with one fact per sentence and the source of each fact beside it, keep what a customer told you apart from what the records show, state the loss, the recovery and what is outstanding to the cent, name any control that failed, and record who decided and who approved. Written that way, the report does three jobs at once: it lets a supervisor check the decision line by line, it gives the BSA team what it needs if a SAR follows, and it still makes sense to an examiner or a prosecutor years later. Most reports fall short because they are typed at the end of a case from five systems, with the evidence pasted in and the sources lost. Botminds' Fraud Case Management drafts the report one cited sentence at a time for the investigator to edit and own.

The worked example is from a fictional sample bank, Corvane National Bank, and an account takeover at its business customer, Ridgeline Auto Body LLC. The bank, the customer, the people and every figure about them are invented sample data.

What should a fraud investigation report include?

Everything a stranger needs to reach the same decision without reopening five systems: the decision, the chronology, the evidence and its sources, the customer's own account, the classification, the money, the reason the loss falls where it does, any failed control, and the names of the people who decided and approved. The template above sets these out as ten sections. Leave none out, even when one says "none" or "not available"; an empty section is information, a missing one is a question.

The report is not a private note. If the case leads to a SAR, the documents behind the filing are supporting documentation the bank must keep for five years and, under the SAR rule, it "shall make all supporting documentation available to FinCEN or any Federal, State, or local law enforcement agency" and to its BSA examiners on request. Write it for that reader as well as for your supervisor.

Start with the decision, then the facts

Put the conclusion in the first two lines, because every later reader opens the report to find it. A supervisor wants to know what they are approving; an auditor wants to know what was decided before checking why. The sample case's report opens: "Confirmed third-party fraud: a takeover of the owner's digital banking login through her compromised email. Reimburse the customer $22,300.00 and close." The decision code, FD-ATO-2, sits beside it with the names of who proposed, who decides and who approves.

Then tell the story in time order. Chronology is the structure that survives: it lets a reader see cause and effect, and gaps in time are themselves evidence. On the sample case, the device log gave the spine to the minute: a password reset requested at 6:41 a.m., completed from a never-seen Android phone at 6:44, the mobile number changed at 6:47, a check deposited from the same phone at 6:52, a new wire payee added at 7:03, the wire released at 7:09.

One fact per sentence, one source per fact

Each sentence should say one thing and point to the record that proves it. It is the single habit that makes a report checkable. In the solution, the drafting agent writes no sentence it cannot cite, and each citation opens the passage it rests on; a sentence a person types is marked as theirs. On the sample case all 17 sentences carried a citation.

One source, opened from the sentence that cites it

Citations are also how you write numbers you can defend. "The check was counterfeit" is an assertion. "Check #1182 for $2,800.00 was returned unpaid on October 15 as counterfeit; its serial is outside the 4410 to 4630 range the maker uses this year" is a fact with two sources, the return and the maker's check stock, and either can be opened.

Separate what you saw from what someone told you

Write the customer's account as the customer's account, and never let it harden into fact by repetition. It is the most common way a well-meant report goes wrong, and on the sample case it is the one error that was caught. The drafted sentence read: "The owner clicked a phishing link in an email on October 12, which gave the fraudster her mailbox." Its only source was the owner's call, in which she said what she believed. No mail header, provider record or forensic report was in the file.

In the solution a quality agent reads every sentence against its source before the supervisor sees the report and challenges any that the source does not support. It scored the phishing sentence at 0.58 against a threshold of 0.70 and suggested the reliable version in the table. The supervisor accepted it, and the edit is recorded as his.

Loss, recovery and outstanding, tied to the cent

Give three numbers and show they add up: what was lost, what came back and what is outstanding, with a line for each transaction and each recovery. On the sample case: the $48,600 wire, $29,100 returned on the recall; the $9,800 ACH debit, recovered in full through an R29 return; the $2,800 counterfeit deposit, no recourse. Loss $61,200, recovered $38,900, outstanding $22,300. The two general ledger entries, $19,500 and $2,800, add to the outstanding figure.

Say what is still open. The wire recall on the sample case stays open to January 12, 2027, so the outstanding figure can still fall; a report that does not say so invites someone to close the recall by mistake. And say who bears the outstanding loss and why. Ridgeline is a business customer, so its wire is governed by Article 4A of the Uniform Commercial Code, under which a bank can hold its customer to an unauthorized order only if its security procedure was commercially reasonable and the bank followed it. The report's liability section turned on the payee hold that did not fire.

Name the control that failed

A report that only closes the case wastes half its value. If a control should have stopped the fraud, name it, say why it did not, and record where the finding went. On the sample case, the binder's bank-standard tab showed that standard OBS-7 requires a 24-hour hold on new payees after a mobile number change, but release 26.07 attached the hold only to the security settings page, and the fraudster changed the number on the profile page. That became rule gap RG-114, sent to fraud strategy. The sample bank's quarterly report later showed 14 cases and $212,400 of gross loss tied to that gap in a single month.

How is a fraud investigation report used for a SAR?

It becomes the BSA team's source. The fraud investigator does not write the SAR, but the BSA analyst who does will take the subject details, the dates and amounts, the method and the chronology from the fraud report, and the report becomes supporting documentation if a SAR is filed. FinCEN's guidance on specific fraud types tells you what that reader needs. Its 2019 business email compromise advisory says institutions "are required to file complete and accurate reports that incorporate all relevant information available, including cyber-related information", and asks for the key term "BEC FRAUD" in the narrative when businesses are the victims.

The SAR narrative is a different document with a different reader. How the BSA team writes it is set out in how to write a SAR narrative, and what a complete AML investigation report looks like, traced from statement to SAR, in an AML investigation report sample. The fraud report should never mention whether a SAR was filed: that is confidential, and on the sample bank the fraud case holds only the referral's reference. How the two teams share a file without breaking that rule is in fraud and AML convergence.

How long should a fraud investigation report be?

As long as the facts need and no longer: there is no prescribed length. A clean single-transaction case may need a paragraph; the sample takeover, with three payment types, two recoveries and a control failure, needed 17 sentences plus the loss table. Length grows with facts, not with adjectives. For the narrower question of documenting a decision not to file a SAR, the 2025 interagency FAQs say there is no requirement to document it, and that where a bank chooses to, "a short, concise statement documenting a financial institution’s SAR decision will likely suffice" in most cases. That applies to the BSA team's decision; the fraud team still documents its own decision on the loss.

Who reviews a fraud investigation report?

At least four readers, in this order. The supervisor approves the decision, the reimbursement and the general ledger entries; on the sample bank up to $50,000 of net loss, with the Chief Fraud Officer above that. A quality analyst samples closed reports; the sample bank's analyst reviews 6 percent of closed cases a week. The BSA officer reads the reports referred for a possible SAR. Internal audit and examiners read samples later, sometimes years later.

The quality agent's reading: the reviewer before the reviewer

Write for the last reader. The supervisor knows the case; the examiner two years on knows nothing but what is written. That is why sources, times and names matter more than polish.

The report on the sample case is shown in full, sentence by sentence, on the Fraud Case Management page; the steps that come before it are in the fraud investigation process in banks.

Questions people ask

Is there a fraud investigation report template?

There is no regulatory template for an internal fraud report; banks set their own. A sound one has ten parts: header, decision, chronology, the customer's account, evidence considered, classification, loss and recovery, liability, control gap, and referral and approvals. The template at the top of this page sets them out with a worked example.

What evidence goes in a fraud investigation report?

Whatever the decision rests on, cited where it is used: transactions, device and session logs, images of deposited items, call recordings or transcripts, prior cases, recovery records and the bank's own standards. For email-compromise fraud, FinCEN's 2019 advisory lists IP addresses with timestamps and the timing of suspicious emails among the details most useful to law enforcement.

What is the difference between a fraud investigation report and a SAR narrative?

The fraud report records the bank's decision on a loss: what happened, who pays and what was recovered. The SAR narrative tells FinCEN and law enforcement why activity is suspicious, and is written by the BSA team. The fraud report often becomes supporting documentation for the SAR.

Should a fraud investigation report include the customer's statement?

Yes, labelled as the customer's account with when and how it was given. Never restate it as fact; on the sample case, the one sentence challenged before approval was a customer's belief written as a finding.

Can AI write a fraud investigation report?

It can draft one if every sentence is tied to a source and a person edits, approves and owns it. In Fraud Case Management the drafting agent writes no sentence it cannot cite and proposes no decision below 0.80 confidence, and the investigator decides.