Transaction Risk Skoor 40 (review band) on a $870.15 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 6d036b7d-f663-4ad8-8718-85126bb29c25 was opened by the skoor_review detector on transfer acht_sim_harb_cqq9xji3940, an $870.15 outgoing ACH debit under the Harbor Marketplace Payouts program. The transfer scored 40 (review band) driven by a single signal: the counterparty has 1 prior unauthorized return. The transfer itself settled with no return code. What the evidence shows. The skoor evidence shows one signal, returns.counterparty_prior_unauthorized, weight 40, which is the entire basis for the review-band score (n=2054, confidence 1). Hard_signal is false. The transfer status is SETTLED with return code none, meaning this specific transfer was not itself returned or reversed. The counterparty's country is unknown, but the paying entity, Dune LLC 13, is VERIFIED, not high risk, not PEP, has no review reasons, and was screened 2026-08-27. Program KRIs are mostly ok or watch; two are flagged breach: manual_review_aging_hours (1438.0 hours, n=15) and ach_unauthorized_return_rate (0.0086, n=812). These are program-level metrics, not specific to this transfer or counterparty, and the alert does not tie them to a broader pattern involving this counterparty or entity. There are no prior dispositions on this alert. What was checked. Checked transfer status and return code (settled, no return), the entity's verification and risk flags (verified, not high risk, not PEP, no review reasons), the single scoring signal and its weight, and the program KRI panel for corroborating signals of a wider issue (concentration, sanctioned-country transfers, stale screening all ok). No signal in the evidence links this specific counterparty's one prior unauthorized return to a pattern across other transfers or entities in this alert. What is recommended. Close the alert. The transfer already settled with no return, the paying entity is verified with no risk flags, and the single review-band signal reflects one historical prior unauthorized return by the counterparty rather than any issue with this transaction. The program-level ach_unauthorized_return_rate and manual_review_aging_hours breaches are noted but are not tied to this transfer or counterparty in the evidence provided and should be tracked separately at the program level rather than resolved through this alert.

{
  "n": 2054,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}