Transaction Risk Skoor 40 (review band) on a $1,971.50 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 23b26e13-98c2-4e11-84ad-0f9c63788e98 was opened on 2026-09-17T19:31:51.617Z by the skoor_review detector on outgoing ACH transfer acht_sim_lant_cpmtltuze91 for $1,971.50 to counterparty cpty_sim_lant_asr3v7ggcjp. The transfer risk score was 40, placing it in the review band, driven by a single signal: one prior unauthorized return recorded against this counterparty (weight 40, confidence 1, n=692). What the evidence shows. The transfer itself is status SETTLED with return code none, meaning this specific transaction completed without any return or dispute. The hard_signal flag on the alert is false. The debiting entity, Cedar Services 314 (enti_sim_lant_coagxc8rchq), is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened as recently as 2026-08-25. Program-level KRIs for Lantern Lending are mostly within normal range: ach_unauthorized_return_rate=0, ach_overall_return_rate=0.012 (n=248), verification_denial_rate=0.030, sanctioned_country_transfers=0, and manual_review_rate=0.012. Two KRIs show elevated aging (hold_aging_hours watch at 1406 hours, manual_review_aging_hours breach at 1434 hours, n=6), but these are program-wide operational metrics not tied specifically to this transfer or counterparty. Counterparty country is listed as unknown, but no sanctioned-country or velocity anomalies are flagged against this transfer. What was checked. Reviewed the alert evidence and signal detail, the transfer record (status, amount, rail, return code, timestamps), the associated program declared volume and KRI panel, the entity verification and screening record, and prior dispositions on this subject. No prior dispositions exist for this alert. What is recommended. The transfer has already settled with no return, and the single triggering signal (a prior unauthorized return on this counterparty) is historical and already reflected in the review-band score with no corroborating signal on this transaction (no sanctioned-country flag, no velocity anomaly, no entity risk flag). There is no pending transfer to hold or release. Close the alert; no further action is needed on this settled transaction. If the counterparty's unauthorized-return history recurs on a future transfer, that should be evaluated at that time.

{
  "n": 692,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}