Identifying suspicious activity is not an exact science. Know the red flags.