I have a client that fell for online/telephone scam.  Unfortunately, the scammer was able to gain control of her computer and withdrew almost $500,000 from her IRA.  I am not quite sure how to report this for 2021.  It seems that she will need to report the $500,000 withdrawal as income and then claim a casualty/theft loss on Form 4684.  From there is appears that under Rev Proc 2009-20, she would qualify for a deduction of 95% of the loss.  Does that sound correct and is there anything else that I am missing?