Transaction Risk Skoor 40 (review band) on a $692.99 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 478da11b-4271-401f-9f39-95a3f303510c fired on an outgoing ACH transfer (acht_sim_harb_augndnlr62c, $692.99) under the Harbor Marketplace Payouts program. The transfer risk score was 40, placing it in the review band, driven by a single signal: the counterparty has 2 prior unauthorized returns. What the evidence shows. The transfer is already SETTLED with return code none, so no funds are currently in transit or held. The originating entity, Alder Co 112, is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date (2026-06-29). The one signal driving the score is returns.counterparty_prior_unauthorized, weighted 40, based on 2 prior unauthorized returns tied to counterparty cpty_sim_harb_gzii64r41f, whose country is unknown. Confidence on the transfer skoor is 1 with n=781. At the program level, two KRIs show breach status: manual_review_aging_hours (1438.03 hours, n=5) and ach_unauthorized_return_rate (0.00847, n=236). Two more KRIs are at watch: pep_flagged_entities (1 of 30) and high_risk_entity_share (0.0667). All other KRIs are ok or unmeasured. There are no prior dispositions on this alert. What was checked. Reviewed the alert evidence, the transfer record and its status, the entity verification profile, and the program KRI snapshot. Confirmed the transfer already settled with no return code, so no transfer is held pending release. Checked whether the entity itself carries independent risk markers (high risk, PEP, stale screening) and found none. Checked whether the driving signal is corroborated at the program level and found two related KRIs (unauthorized return rate, manual review aging) in breach. What is recommended. This transfer is settled with no return, so there is nothing to hold or release on this alert. The originating entity is clean on verification and screening. However, the counterparty's repeat unauthorized-return history, combined with program-level breaches in unauthorized return rate and manual review aging, points to a pattern extending beyond this single transaction. A person should review counterparty cpty_sim_harb_gzii64r41f across the portfolio and the program's aging manual-review backlog rather than treat this as a one-off closure.

{
  "n": 781,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}