Transaction Risk Skoor 40 (review band) on a $532.12 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An ACH outgoing credit transfer of $532.12 to counterparty cpty_sim_harb_5p4yfvh5vq settled on 2026-09-07 under the Harbor Marketplace Payouts program. The skoor_review detector generated a medium-severity alert on 2026-09-17 because the counterparty has one prior unauthorized ACH return on record, producing a risk score of 40 (review band). What the evidence shows. The single scoring signal is returns.counterparty_prior_unauthorized, weight 40, based on one prior unauthorized return for this counterparty. The transfer itself has no return code (none) and is SETTLED, so this specific transfer was not itself returned. The subject entity, Dune LLC 13, is VERIFIED, not high risk, not PEP, with no review reasons and a screening date of 2026-08-27, within policy. n=1927 for the scoring population and confidence=1 indicate the score is well-supported statistically, though the underlying evidence is a single historical return event on the counterparty, not on this transaction. At the program level, ach_unauthorized_return_rate is flagged as a breach (0.78%, n=767) and manual_review_aging_hours is also flagged as a breach (1438 hours, n=14). hold_aging_hours, pep_flagged_entities, and high_risk_entity_share are in watch status. Counterparty concentration and sanctioned-country counts are normal. Prior dispositions: none on record for this alert. What was checked. Transfer status and return code, entity verification and screening status, program KRI panel, and prior disposition history were reviewed. No other signals beyond returns.counterparty_prior_unauthorized are present in the evidence, and no information on the counterparty's country or additional return history beyond the single prior event is provided. What is recommended. The transfer has already settled, so there is no held transaction to release or hold. The entity is verified and not otherwise flagged, and this alert alone reflects a single historical counterparty return rather than a fresh unauthorized return on this transfer. However, the program's ach_unauthorized_return_rate is independently flagged as a breach alongside manual_review_aging_hours, which together suggest this alert may be one instance of a broader pattern in the program rather than an isolated case. Given that program-level breach indicators coincide with the same return-type signal driving this alert, this should be escalated for a person to assess whether the counterparty-level unauthorized return pattern and the program's breach-level KRIs are connected, rather than closed as a standalone low-risk item.

{
  "n": 1927,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}