Incident highlighting is either offset (shift-left or shift-right by one or more characters) or just garbled.
This happens when there are emojis or other multi-byte characters in the message body.
The policy is not triggering off the emoji or multi-byte characters.
The presence of emojis or other multi-byte characters in the file or email corrupts the incident display in the console.
This screenshot shows an EDM incident that was triggered by some SSNs.
Note that the incident highlighting is shifted to include non-triggering data and only part of the SSN.
All the data is test data, no actual PII data was used in this test.
The offset highlighting is caused by differences between the encoding of the multi-byte characters and the text in the source document.
This has been corrected in 16.0 RU1.