Case #2026-FRD-0441 — opened 04/14/26 by analyst T. Okafor Subject acct: checking ×4471, opened 2019, Elena M. Vasquez, DOB 12/3/1981 — longtime customer, no prior issues, avg monthly bal ~$4,200 Timeline: 03/28 ~11pm — login from new device (Android, Chicago IP). Customer normally logs in from Phoenix AZ. 03/29 8:14am — password reset via SMS OTP. Customer says she did NOT request this. 03/29 9:02am — new payee added: "RapidPay Solutions LLC" routing 071000013, acct 4400229871 03/29 9:18am — wire transfer $14,900 to RapidPay. No prior wire history on acct. 03/29 11:45am — second wire $13,500 same beneficiary. 03/30 — customer calls in, says she didn't do any of this, account compromised 03/30 — fraud hold placed, account frozen 04/01 — contacted RapidPay bank (Chase). Funds already disbursed, unrecoverable. 04/02 — customer interview: says she received a text claiming to be from us about suspicious activity, clicked link, entered creds. Classic phishing / ATO. 04/05 — device forensics: IP 104.245.x.x traced to Chicago VPN node, no match to customer's known devices. Second wire initiated from same session. 04/08 — reviewed call recordings: no call to customer prior to OTP reset by bank staff. 04/12 — confirmed total loss $28,400. No partial recovery. Customer reimbursed per reg E. Red flags: - new device + new geography login - unsolicited OTP-triggered password reset - new high-value payee added same session - two large wires same day to same new payee — structuring-adjacent - no prior wire activity - beneficiary acct closed 4 days after funds received (per Chase response) Actions taken: - account frozen 03/30 - customer reimbursed $28,400 on 04/03 (Reg E provisional credit) - internal ticket escalated to BSA/AML team 04/06 - 30-day SAR clock started 04/06 (date of determination) - SAR due by 05/06/26