SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

The entity's first transfer, $857.09, above the program median, came 0.0 hours after verification.

Detector
rapid_onboarding
Severity
medium
Program
Harbor Marketplace Payouts (simulated)
Subject
transfer acht_sim_harb_ar15193w3xz
Transfer
acht_sim_harb_ar15193w3xz · $857.09 · ach outgoing
Skoor at alert
null unscored
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:30Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. Alert 5ba0ec34-c5a2-493a-a936-4ecadde629d5 fired on rapid_onboarding detector (severity medium) for entity Heath Holdings 119's first transfer, an outgoing ACH credit of $857.09 to counterparty cpty_sim_harb_c71xa38w3xi, initiated 0.0 hours after identity verification. The transfer has already settled. What the evidence shows. The transfer amount ($857.09) exceeds the program median ($407.61) and occurred immediately (0.0 hours) after verification, which is what triggered the detector given its 24-hour threshold. The transfer risk score is unscored (n=0, band unscored, confidence null), so no scoring model has assessed this transaction. The only listed signal is counterparty.first_time (+10). The transfer settled with no return code, indicating no rail-level failure or reversal. The entity is VERIFIED, not flagged high risk, not PEP, has no review reasons on file, and was last screened 2026-07-07. Counterparty country is listed as unknown. There are no prior dispositions on this entity. What was checked. Reviewed the alert evidence block (thresholds, median, scoring fields), the transfer record (status, amount, return code, rail), the entity record (verification status, risk flags, PEP status, review reasons, screening date), the program declared volume, and prior disposition history. No additional transfers or entity history beyond this first transfer are present in the record. What is recommended. Close the alert. The transfer is a single settled ACH credit with no return code, from a verified, non-high-risk, non-PEP entity, with no scoring signal beyond an unscored first-time counterparty flag and an amount modestly above median. Nothing in the evidence indicates a pattern requiring escalation, and the transfer has already settled so there are no funds to hold or release. The counterparty country being unknown is a minor data gap worth noting for future monitoring but does not on its own warrant escalation given the absence of any other risk indicator.
Recommendation
close
Confidence
0.62
Model
claude-sonnet-5
Drafted
2026-09-17 19:30Z
Rationale
  • Transfer status is SETTLED with no return code, so there is no pending movement to hold or release.
  • Entity is VERIFIED, not high risk, not PEP, with no review reasons and no prior dispositions.
  • Transfer risk score is unscored (n=0, confidence null), meaning no model-based elevated risk determination exists.
  • The only signal present is counterparty.first_time, a common and expected condition for a first transfer, not indicative of a broader pattern on its own.
  • Counterparty country is unknown, which is a data completeness gap rather than a positive risk finding, and tempers confidence slightly.
  • No prior dispositions or repeat entity/counterparty activity in the record to suggest a pattern warranting escalation.

Evidence

{
  "n": 0,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "40761",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Skoor signals

SignalWeightHardDetail
counterparty.first_time+10first transfer with this counterparty
counterparty.first_time_and_large+15amount above the program p95 (78496)

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.