Entity velocity spiked: 1 transfers and $299.89 in 24 hours.

What happened. A velocity_spike alert fired for entity enti_sim_harb_ax0fq0ns3w8, citing 1 transfer totaling $299.89 within a 24-hour window, exceeding 2x the program daily average. The alert is unscored (band unscored, skoor null) and marked as not a hard signal. What the evidence shows. The single transfer record attached to this alert (acht_sim_harb_3br0y7vr3z7) is an ACH outgoing debit of $774.88, completed, created 2026-07-09T20:40:51.000Z — roughly ten weeks before the alert opened on 2026-09-17T19:32:05.027Z, and for a different dollar amount than the $299.89 cited in the alert summary. The transfer-level evidence also carries counterparty.first_time and counterparty.first_time_and_large flags, but the transfer itself is unscored (skoor null, n=2, confidence null). The entity is a VERIFIED person, not high risk, not PEP, with no review reasons and screening current as of 2026-08-29. The transfer status is COMPLETED with no return code, so there are no funds in a holdable state tied to this alert. What was checked. Alert summary and signal detail; the single linked transfer's amount, status, timing, and counterparty; entity verification, risk, and screening status; program KRIs for context. Program KRIs show two items in breach (manual_review_aging_hours and ach_unauthorized_return_rate) and several in watch status, but these are program-wide aggregates (n=15, n=812) and nothing in the evidence ties them specifically to this entity or transfer. Prior dispositions: none. What is recommended. Close the alert. The entity is verified with no risk or PEP flags and current screening. The alert is unscored, not a hard signal, and of medium severity based on a single velocity signal. The transfer cited does not match the alert's stated amount or 24-hour timing, indicating a possible data linkage issue rather than a substantiated velocity event; this should be flagged for detector/data-quality review separately, but it does not raise the risk profile of this specific alert. The transfer is already completed, so there is no fund-holding action available. A person should still review the program-level KRI breaches (manual_review_aging_hours, ach_unauthorized_return_rate) separately, as those are not specific to this alert.

{
  "n": 2,
  "band": "unscored",
  "skoor": null,
  "signals": [
    {
      "code": "velocity.sum_24h_gt_2x_daily_avg",
      "detail": "24h sum above 2× the program daily average",
      "weight": 10
    }
  ],
  "routeReason": "detector not auto-closable"
}