Transaction Risk Skoor 40 (review band) on a $1,068.10 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 5201a10b-d8f5-4ac8-9387-b7b3ebc06464 was opened by the skoor_review detector on 2026-09-17 for an outgoing ACH transfer of $1,068.10 (acht_sim_nort_cf4cchr42v2) under the Northwind Payroll program. The transfer scored 40 (review band, hard signal false) driven by a single signal: the counterparty has 1 prior unauthorized ACH return. What the evidence shows. The transfer itself is SETTLED with return code none, created 2026-08-29, so no return occurred on this specific transaction. The only risk signal is returns.counterparty_prior_unauthorized, weight 40, based on one prior unauthorized return by the counterparty (cpty_sim_nort_25c8izfo4a, country unknown). The originating entity, Heath Holdings 07, is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-07-03. There are no prior dispositions on this alert. What was checked. Transfer status and return code (settled, no return), score composition (single 40-weight signal, n=1059, confidence 1), entity verification and risk flags, and program-level KRIs. Program KRIs are mostly ok or watch (velocity_vs_declared 0.20, ach_unauthorized_return_rate 0, reserve_coverage_ratio 1.62), except manual_review_aging_hours which is in breach (1434.7 hours, n=8) and hold_aging_hours which is watch (518.3 hours, n=1). These KRIs describe program-wide review timeliness, not this specific transfer, and are not tied to the counterparty or entity named in this alert. What is recommended. Close this alert. The flagged transfer already settled without a return, the entity is verified with no other risk indicators, and the single contributing signal reflects a past event by the counterparty rather than an outcome on this transaction. There is no held transfer to release or hold. The manual_review_aging_hours breach is a program-level condition unrelated to this specific alert's evidence and should be tracked separately, not used to escalate this alert.

{
  "n": 1059,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}