Transaction Risk Skoor 40 (review band) on a $659.82 ach transfer: returns.counterparty_prior_unauthorized.

What happened. A skoor_review alert fired on a settled ACH outgoing credit of $659.82 from program Lantern Lending, transfer acht_sim_lant_aixhjfjqeas, because the counterparty has one prior unauthorized ACH return on record. What the evidence shows. The transaction risk skoor is 40, placing it in the review band, driven solely by the signal returns.counterparty_prior_unauthorized (weight 40, detail: 1 prior unauthorized return). The transfer itself carries no return code and is already SETTLED. The associated entity, Birch Holdings 31, is VERIFIED, not high risk, not PEP, with no review reasons, last screened 2026-08-18. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=271) and ach_overall_return_rate at 0.011 (n=271), both in the ok range, with no sanctioned_country_transfers and low counterparty concentration (0.127). manual_review_aging_hours shows a breach (1433.6 hours, n=8) and hold_aging_hours is flagged watch (1406.4 hours, n=3), indicating review backlog at the program level but not specific to this transfer. Prior dispositions for this alert: none. What was checked. Reviewed the alert evidence block, the transfer record (status, return code, amount, rails, counterparty), the entity verification status and risk flags, and the program KRI panel for corroborating patterns (unauthorized return rate, sanctioned country exposure, concentration, PEP flags). No other signals beyond the single prior-unauthorized-return code were present in the evidence. What is recommended. This transfer has already settled, so there is no fund movement to hold or release. The single driving signal is one historical unauthorized return by the counterparty, with no unauthorized return on this transfer itself and no other risk indicators on the entity or program tied to this transfer. Absent additional signals or a pattern across other transfers with this counterparty, this alert can be closed. The program-level manual_review_aging_hours breach is noted separately and should be tracked as a program-level operational item, not as grounds to hold this individual settled transfer.

{
  "n": 719,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}