Alert · reviewed · open

Transaction Risk Skoor 40 (review band) on a $762.38 ach transfer: returns.counterparty_prior_unauthorized.

Detector: skoor_review
Severity: medium
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_b0qvp9s4drh
Transfer: acht_sim_lant_b0qvp9s4drh · $762.38 · ach outgoing
Skoor at alert: 40 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert 023766b2-7451-4ff2-9f45-3c17d85a7b45 fired on outgoing ACH transfer acht_sim_lant_b0qvp9s4drh for $762.38, flagged by the skoor_review detector at Transaction Risk Skoor 40 (review band) due to a single signal: the counterparty has one prior unauthorized return on record. What the evidence shows. The transfer itself settled with no return code (return code: none), meaning this specific transaction completed without an authorization dispute. The skoor is driven entirely by one signal (returns.counterparty_prior_unauthorized, weight 40) with detector confidence 1 and sample size n=481. The subject entity, Birch Holdings 325, is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened as recently as 2026-06-22. Program-level KRIs show ach_unauthorized_return_rate at 0 across 164 transfers, which does not support a broader unauthorized-return pattern tied to this program. Two other KRIs are flagged watch/breach (hold_aging_hours, manual_review_aging_hours), but these relate to review-queue timing across the program, not to this transfer or counterparty specifically. What was checked. Reviewed the alert evidence block, transfer status and return code, entity verification and screening status, program KRI panel, and prior dispositions. No prior dispositions exist for this alert. The transfer is already SETTLED, so it is not in a held state. What is recommended. Because the transfer has already settled with no return, the counterparty flag is a single historical data point rather than a pattern (program-wide unauthorized return rate is 0), and the subject entity carries no other risk indicators, no person action is needed on this alert. Close the alert. The manual_review_aging_hours breach is a separate program-level condition unrelated to this specific transaction's risk and does not change this disposition.

Recommendation

Confidence

0.70

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Transfer status is SETTLED with return code none; funds are not in a held state, so hold/release do not apply.
The sole risk signal is one prior unauthorized return by the counterparty (weight 40), which alone placed the skoor in the review band.
Program ach_unauthorized_return_rate is 0 across n=164, showing no corroborating pattern at the program level that would warrant escalation.
Subject entity is VERIFIED, not high risk, not PEP, with no open review reasons and recent screening (2026-06-22).
Program KRI breaches present (hold_aging_hours watch, manual_review_aging_hours breach) are queue-timing metrics unrelated to this transfer's counterparty risk and do not change the disposition of this specific alert.
No prior dispositions exist to indicate recurring concern for this subject or counterparty.

Evidence

{
  "n": 481,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_unauthorized	+40		1 prior unauthorized return(s)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.