Transaction Risk Skoor 40 (review band) on a $711.69 ach transfer: returns.counterparty_prior_unauthorized.

What happened. A $711.69 ACH outgoing debit transfer (acht_sim_lant_6x175eu4e3o) under Lantern Lending was flagged by the skoor_review detector at a Transaction Risk Skoor of 40, placing it in the review band. The trigger was a single signal: the counterparty (cpty_sim_lant_asr3v7ggcjp) has one prior unauthorized ACH return on record. What the evidence shows. The transfer itself settled with no return code, meaning this specific transaction did not experience an unauthorized return. The skoor is driven entirely by the counterparty's return history (weight 40, n=637, confidence 1), and hard_signal is false. The originating entity, Cedar Services 314, is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened on 2026-08-25. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=219) and ach_overall_return_rate at 1.37% (n=219), both in the ok range, indicating no broader pattern of unauthorized returns tied to this program. Velocity vs declared volume (0.232) and counterparty concentration (0.132) are also within normal range. The one KRI in breach, manual_review_aging_hours (1433.6 hrs, n=6), reflects review queue timing across the program and is not specific to this alert. What was checked. Transfer status and return code, skoor evidence and signal weighting, entity verification and screening status, program declared volume against actual velocity, and all listed program KRIs for signs of a wider counterparty or program-level return problem. What is recommended. Close the alert. The transfer has already settled without an unauthorized return, the flagged entity is verified with no other risk indicators, and program-wide unauthorized return metrics do not corroborate a broader pattern. No funds are pending, so no hold is applicable. If a second unauthorized return event occurs on this counterparty, escalate at that point given the repeat-behavior implication.

{
  "n": 637,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}