Alert · reviewed · open

Transaction Risk Skoor 30 (review band) on a $243.88 ach transfer: returns.counterparty_prior_any, returns.entity_rate_gt_threshold.

Detector: skoor_review
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_7isq8d3d81e
Transfer: acht_sim_harb_7isq8d3d81e · $243.88 · ach outgoing
Skoor at alert: 30 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:31Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An outgoing ACH credit transfer of $243.88 to counterparty cpty_sim_harb_bmqeuc7o3xi was flagged by the skoor_review detector at a skoor of 30 (review band, hard_signal false) on two signals: one prior non-NSF return for the counterparty and an entity unauthorized ACH debit return rate of 1/29 over 60 days. What the evidence shows. The transfer has already SETTLED with no return code recorded, meaning the funds moved without issue. The entity, Grove Co 16, is VERIFIED, not flagged high risk, not PEP, has no open review reasons, and was screened on 2026-07-01. The counterparty's country is unknown but no sanctioned-country or velocity signal is present. Program-level KRIs show ach_unauthorized_return_rate and manual_review_aging_hours in breach status, but these are portfolio-wide measures (n=623 and n=9 respectively) and are not tied specifically to this transfer or entity in the evidence provided. There are no prior dispositions on this alert. What was checked. Transfer status and return code, entity verification and risk/PEP flags, screening recency, program KRI panel, and prior disposition history. No additional transfer-level data (e.g., counterparty return history beyond the one cited signal) was available. What is recommended. Since the transfer already settled with no return and the entity shows no independent risk indicators beyond the two scored signals, no further action is needed on this specific transfer. The program-level KRI breaches (ach_unauthorized_return_rate, manual_review_aging_hours) are noted for separate portfolio-level monitoring but do not, on the evidence given, tie back to this alert's entity or transfer.

Recommendation

Confidence

0.68

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Transfer status is SETTLED with return code none, so there is no pending movement of funds to hold or release.
Entity is VERIFIED, not high risk, not PEP, with no open review reasons and recent screening.
The two scoring signals (prior counterparty return, entity unauthorized return rate) are already reflected in the skoor and placed the alert in the review band, but neither corresponds to a new adverse event on this transfer itself.
Program KRI breaches for ach_unauthorized_return_rate and manual_review_aging_hours are portfolio-level and not directly attributed to this entity or transfer in the evidence, so they do not support escalation of this specific alert.
No prior dispositions exist to indicate a recurring pattern for this entity or counterparty.

Evidence

{
  "n": 1619,
  "band": "review",
  "skoor": 30,
  "signals": [
    {
      "code": "returns.counterparty_prior_any",
      "detail": "1 prior return(s) other than NSF",
      "weight": 15
    },
    {
      "code": "returns.entity_rate_gt_threshold",
      "detail": "entity unauthorized return rate 1/29 originated ACH debits in 60d",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_any	+15		1 prior return(s) other than NSF
returns.entity_rate_gt_threshold	+15		entity unauthorized return rate 1/29 originated ACH debits in 60d

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.