SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

The entity's first transfer, $2,767.71, above the program median, came 0.0 hours after verification.

Detector
rapid_onboarding
Severity
medium
Program
Northwind Payroll (simulated)
Subject
transfer acht_sim_nort_4wk5s2gd8i
Transfer
acht_sim_nort_4wk5s2gd8i · $2,767.71 · ach outgoing
Skoor at alert
null unscored
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:30Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. The alert fired on transfer acht_sim_nort_4wk5s2gd8i, an outgoing ACH debit of $2,767.71 from entity Grove Co 06, flagged by the rapid_onboarding detector because the transfer occurred 0.0 hours after verification, within the 24-hour threshold, and the amount exceeded the program median of $1,818.09. What the evidence shows. The transfer has already settled with no return code, indicating no rejection or dispute occurred. The entity is a verified US business, not high risk, not PEP, with no review reasons on file and a screening date of 2026-07-06. The transfer skoor is null/unscored with n=15, so no statistical model backs this alert beyond the raw threshold comparison. The counterparty's country is unknown, which is a gap in the evidence. Prior dispositions for this entity are none, so there is no history of similar flags to indicate a pattern. What was checked. Program declared monthly volume ($2,500,000.00), transfer status and return code, entity verification status and risk flags, screening date, transfer skoor and band, and prior disposition history. All fields were reviewed as provided; no external data was available. What is recommended. The transfer has already settled, so holding funds is not an option; this alert concerns a completed transaction rather than one in a holdable state. The entity is verified with no risk flags, the amount is above median but not extreme relative to the declared program volume, and the transfer completed without a return code. The unscored skoor and unknown counterparty country are gaps, but nothing in the evidence indicates a person must intervene now given the transfer already settled and the entity's clean verification profile. A person should still confirm the counterparty country is benign given it is unrecorded here.
Recommendation
close
Confidence
0.55
Model
claude-sonnet-5
Drafted
2026-09-17 19:30Z
Rationale
  • Transfer status is SETTLED with no return code, indicating no processing issue.
  • Entity is VERIFIED, not high risk, not PEP, with no review reasons.
  • No prior dispositions exist for this entity, so no pattern is evidenced.
  • Transfer skoor is null/unscored (n=15), limiting statistical confidence in this being anomalous beyond the raw threshold trigger.
  • Counterparty country is unknown, which is a residual gap not fully resolved by available evidence, tempering confidence.

Evidence

{
  "n": 15,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "181809",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.