Transaction Risk Skoor 40 (review band) on a $316.36 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An ACH outgoing debit of $316.36 from Harbor Marketplace Payouts to counterparty cpty_sim_harb_1iejz6444vr was flagged by the skoor_review detector at Transaction Risk Skoor 40 (review band), driven by a single signal: the counterparty has one prior unauthorized return on record. The transfer itself settled with no return code. What the evidence shows. The transfer already settled cleanly (status SETTLED, return code none), so the funds have moved and there is nothing pending to hold. The skoor is driven entirely by one prior unauthorized return on this counterparty, weighted at 40, which alone places it in the review band (hard_signal false). The entity behind the program, Birch Holdings 11, is VERIFIED, not high risk, not PEP, and was screened 2026-07-02 with no review reasons. At the program level, the KRI panel shows ach_unauthorized_return_rate at 0.0108 flagged as a breach (n=556), and manual_review_aging_hours at 1438 hours also flagged as a breach (n=9). Several other KRIs (pep_flagged_entities, high_risk_entity_share, hold_aging_hours) sit in watch status. There are no prior dispositions on this alert. What was checked. Reviewed the alert evidence block, the transfer record, the linked entity's verification and screening status, and the program-level KRI panel. Confirmed the transfer status (settled, no return), confirmed the entity has no high-risk or PEP flags, and confirmed there is no disposition history to draw on. What is recommended. The individual transfer poses no immediate funds-movement risk since it has already settled and the associated entity is verified and clean. However, the program-level ach_unauthorized_return_rate is flagged as a breach, and this alert's sole trigger is a prior unauthorized return on the same rail. This alignment between a program-wide breach metric and the specific signal driving this alert suggests the single counterparty flag may be part of a broader pattern across the program rather than an isolated event. This should be escalated for a person to review whether the unauthorized-return breach reflects a systemic counterparty or program issue beyond this one transfer.

{
  "n": 1485,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}