Transaction Risk Skoor 40 (review band) on a $775.69 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 4eff256b-449e-447c-940d-130839eef1df fired on outgoing ACH debit acht_sim_harb_bkjg8x409fg for $775.69, initiated 2026-09-15 and now SETTLED with no return code. The detector skoor_review scored the transfer 40 (review band) driven by a single signal, returns.counterparty_prior_unauthorized, weighted 40, based on 2 prior unauthorized returns tied to counterparty cpty_sim_harb_39i9ftby3xi. What the evidence shows. The transfer itself settled cleanly with no return code, so there is no indication this specific transaction was returned or disputed. The risk signal is historical: the counterparty has 2 prior unauthorized returns on record. The originating entity, Heath Holdings 17, is VERIFIED, not high risk, not PEP, with review reasons none and screening current as of 2026-08-27. Program-level KRIs show ach_unauthorized_return_rate at 0.0091 (n=877) flagged as a breach, and manual_review_aging_hours at 1438 hours (n=16) also flagged as a breach. Other KRIs (velocity_vs_declared, counterparty_concentration_top1, reserve_coverage_ratio, sanctioned_country_transfers) are within normal range. There is no prior disposition history for this alert or entity. What was checked. Reviewed the transfer status and return code, the entity's verification and risk flags, the program-level KRI panel, and prior dispositions. Confirmed the alert's hard_signal flag is false and route reason is 'detector not auto-closable,' meaning the system itself did not resolve it automatically. What is recommended. This transfer already settled, so there are no funds to hold or release. However, the counterparty's prior unauthorized-return history combined with a program-level breach on ach_unauthorized_return_rate suggests this may not be an isolated incident. A person should review whether this counterparty is generating a pattern of unauthorized returns across the program before further transfers to it are processed.

{
  "n": 2206,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}