Transaction Risk Skoor 40 (review band) on a $1,783.79 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An ACH outgoing credit transfer of $1,783.79 from entity Fern Studio 35 (program Lantern Lending) was flagged by the skoor_review detector at a Transaction Risk Skoor of 40, placing it in the review band. The triggering signal is one prior unauthorized return associated with the counterparty. What the evidence shows. The transfer has already settled with no return code on this transaction itself. The single signal driving the score is a historical unauthorized return tied to counterparty cpty_sim_lant_asr3v7ggcjp, weighted at 40, which is the full score. The entity Fern Studio 35 is verified, not high risk, not PEP, with no open review reasons and screening current as of 2026-08-12. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=190) and ach_overall_return_rate at 0.0105 (n=190), both in the ok range, indicating this pattern is not elevated at the program level. Manual_review_aging_hours is in breach (1433.6 hours, n=5) and hold_aging_hours is at watch (1406.4 hours, n=2), which reflect review queue timeliness rather than this specific transfer. There are no prior dispositions on this alert. What was checked. Transfer status and return code, counterparty and entity verification status, program-level KRIs for return rates and concentration, and prior disposition history. No hard signal was present (hard_signal: false), and confidence on the detector's evidence is 0.82. What is recommended. This transfer has already settled, so no funds can be held on it. A person should review the counterparty's prior unauthorized return history before this counterparty is used again, but there is no basis in the evidence to treat this as an active risk requiring escalation beyond this single alert, since program-level unauthorized and overall return rates are within normal range. Recommend closing this alert with a note to monitor the counterparty for repeat unauthorized returns.

{
  "n": 552,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.82,
  "routeReason": "detector not auto-closable"
}