Transaction Risk Skoor 40 (review band) on a $608.77 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 1fd0f0c8-3369-4653-af6c-3fd98e420f09 was opened by the skoor_review detector at medium severity on a $608.77 ACH outgoing debit transfer (acht_sim_meri_794wpnlubl5) under program Meridian Remit. The transfer received a Transaction Risk Skoor of 40, placing it in the review band, driven solely by the signal returns.counterparty_prior_unauthorized (weight 40, detail: 1 prior unauthorized return). What the evidence shows. The transfer itself is SETTLED with return code none, meaning no return has occurred on this specific transaction. The counterparty (cpty_sim_meri_4t9h3oztaja) has one prior unauthorized return on record, which is the entire basis for the skoor. The originating entity, Heath Holdings 219, is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-07-03. Skoor confidence is 0.94 on n=737, indicating a stable model population. At the program level, three KRIs are in breach: reserve_coverage_ratio (0.80, n=280), ach_unauthorized_return_rate (0.0143, n=280), and manual_review_aging_hours (1146.86, n=2). Hold_aging_hours (1364.97, n=4) and pep_flagged_entities (1, n=30) are in watch status. All other KRIs (velocity, sanctioned country transfers, verification denial rate, concentration, administrative return rate) are within normal range. What was checked. Transfer status and return code, entity verification and screening status, program declared volume and rails, the single triggering signal and its weight, and the full program KRI panel for corroborating or contradicting patterns. Prior dispositions were checked and none exist for this alert. What is recommended. This individual transfer shows no return and a verified, low-risk originating entity, so nothing about this specific transaction requires the transfer to be held or reversed. However, the program-level KRI breaches in ach_unauthorized_return_rate and reserve_coverage_ratio, combined with a manual_review_aging_hours breach, indicate a pattern at the program level that this single alert does not fully capture. This alert should be escalated for review of the Meridian Remit program's unauthorized return trend and reserve coverage rather than closed as an isolated item.

{
  "n": 737,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.94,
  "routeReason": "detector not auto-closable"
}