Transaction Risk Skoor 55 (review band) on a $830.73 ach transfer: returns.counterparty_prior_unauthorized, geo.outside_declared_countries.

What happened. Alert 3e6509ec-073f-4b3b-a1a5-8f95cd694858 fired on 2026-09-17 for ACH outgoing transfer acht_sim_harb_5ohwtxo498s, a $830.73 credit that settled on 2026-09-13. The skoor_review detector scored the transfer 55 (review band) based on two signals: 2 prior unauthorized returns tied to the counterparty (weight 40) and the counterparty's country (AE) falling outside the program's declared countries (US only, weight 15). What the evidence shows. The transfer status is SETTLED with no return code recorded, meaning the funds have already moved and there is no hold to act on. The counterparty (cpty_sim_harb_1fd2i6t54k3) is located in AE, which is not among the program's declared operating countries (US). The counterparty has 2 prior unauthorized returns on record. The sending entity, Cedar Services 12, is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-09-01. Program-level KRIs show ach_unauthorized_return_rate at 0.00816 flagged as breach and manual_review_aging_hours at 1438 hours flagged as breach; other KRIs (frozen_accounts, overdraft_events, card_fraud_declines, pep_flagged_entities, high_risk_entity_share) sit in watch status. Confidence on the transfer-level evidence is stated as 1.0 (n=2140 for the model, n=858 for the KRI base). What was checked. Reviewed the transfer record, program declared countries and rails, the sending entity's verification and screening status, the skoor signal detail, and the full set of program KRIs including return-rate and aging metrics. No prior dispositions exist for this alert or subject. What is recommended. This alert cannot be resolved as a routine close: the counterparty's prior unauthorized-return history combined with an undeclared-country geo signal, together with the program's own breach-level ach_unauthorized_return_rate and manual_review_aging_hours KRIs, indicate a pattern that extends beyond this single settled transfer. Because the transfer is already settled, there is nothing to hold or release; a person should review the counterparty's transaction history and the program's broader return-rate breach to determine whether other transfers to this or related counterparties warrant action.

{
  "n": 2140,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "geo.outside_declared_countries",
      "detail": "counterparty country AE not declared by the program",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}