Alert · reviewed · open

Transaction Risk Skoor 55 (review band) on a $2,301.81 ach transfer: returns.counterparty_prior_unauthorized, returns.entity_rate_gt_threshold.

Detector: skoor_review
Severity: medium
Program: Northwind Payroll (simulated)
Subject: transfer acht_sim_nort_9h536x1v3jk
Transfer: acht_sim_nort_9h536x1v3jk · $2,301.81 · ach outgoing
Skoor at alert: 55 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. A $2,301.81 outgoing ACH debit (acht_sim_nort_9h536x1v3jk) from the Northwind Payroll program was flagged by the skoor_review detector at a risk score of 55 (review band). The flag was driven by two signals: the counterparty has one prior unauthorized return, and the entity's unauthorized return rate (1/35 originated ACH debits in 60 days) exceeds the configured threshold. What the evidence shows. The transfer itself settled with no return code, meaning it was not returned or reversed. The entity, Grove Co 018, is VERIFIED, not high risk, not PEP, with no open review reasons and a screening date of 2026-09-14 that postdates the transfer. Program-level KRIs show ach_unauthorized_return_rate at 0.16% (ok) and ach_overall_return_rate at 1.28% (ok), both within normal range, indicating this entity's 1/35 rate is an outlier relative to the broader program rather than a program-wide problem. counterparty_concentration_top1 is 9.2% (ok), and sanctioned_country_transfers is 0. The one elevated program metric, manual_review_aging_hours at 1434.7 (breach), reflects backlog in review processing generally and is not tied to this specific transfer or counterparty. What was checked. Transfer status and return code, entity verification and screening status, program KRIs for unauthorized/administrative/overall return rates, high-risk and PEP entity share, counterparty concentration, and prior dispositions on this alert (none on file). No hard signal was present at scoring (hard signal: false), and detector confidence was 1 with n=1368. What is recommended. Close the alert. The flagged transfer settled without a return, the entity is verified with no open review reasons, and the counterparty's single prior unauthorized return has not recurred on this transaction. Program-wide return-rate KRIs remain in the ok band, so the underlying signals do not indicate a broader pattern tied to this alert. The manual_review_aging_hours breach is a separate operational metric and should be tracked independently of this disposition, not as grounds to hold funds already settled.

Recommendation

Confidence

0.72

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer status is SETTLED with return code none; no funds are pending movement, so hold/release do not apply.
Entity is VERIFIED, not high risk, not PEP, with no open review reasons and a recent screening date after the transfer.
Program KRIs for unauthorized (0.16%) and overall (1.28%) ACH return rates are in the ok band, indicating no systemic pattern beyond this single counterparty signal.
The two triggering signals (prior unauthorized return, entity rate above threshold) are based on a small sample (1/35) and did not produce a hard signal (hard signal: false).
No prior dispositions exist on this alert, so this is a first-time review with no escalation history to build on.
The manual_review_aging_hours breach is a separate, program-level operational KRI and does not evidence a pattern specific to this transfer or counterparty.

Evidence

{
  "n": 1368,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "returns.entity_rate_gt_threshold",
      "detail": "entity unauthorized return rate 1/35 originated ACH debits in 60d",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_unauthorized	+40		1 prior unauthorized return(s)
returns.entity_rate_gt_threshold	+15		entity unauthorized return rate 1/35 originated ACH debits in 60d

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.