Transaction Risk Skoor 40 (review band) on a $567.47 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An ACH outgoing debit transfer of $567.47 from Harbor Marketplace Payouts to counterparty cpty_sim_harb_5p4yfvh5vq was flagged by the skoor_review detector at a skoor of 40 (review band), driven by a single signal: the counterparty has one prior unauthorized return on record. What the evidence shows. The transfer itself settled with no return code, meaning this specific transaction completed without incident. The skoor is 40, placing it in the review band, and hard_signal is false, indicating the detector did not treat this as a high-confidence stop signal. The only contributing signal is 'returns.counterparty_prior_unauthorized' with a weight of 40, reflecting one prior unauthorized return for this counterparty, not a pattern of repeated unauthorized returns. The debiting entity, Elm Partners 14, is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened as recently as 2026-07-08. The counterparty's country is unknown, but no sanctioned-country or high-risk-entity signal fired for this alert. At the program level, ach_unauthorized_return_rate is flagged as a breach (0.0097 against n=411) and manual_review_aging_hours is also a breach (1438 hours against n=7), but these are aggregate KRIs not specific to this counterparty or transfer, and no prior dispositions exist tying this alert to a broader case. What was checked. Transfer status and return code, skoor and signal detail, entity verification status and screening recency, program KRI panel, and prior disposition history. No other signals fired on this transfer (n=1182/1201 population, confidence 0.985). No hard signal was present, and the transfer already settled, so no funds are pending or held. What is recommended. Close this alert. The evidence is limited to a single prior unauthorized return on the counterparty with no corroborating signal, the current transfer settled cleanly, and the debiting entity is verified with no risk flags. The transfer is already settled, so there is no held transfer to release. The program-level KRI breaches (unauthorized return rate, manual review aging) are noted for separate program-level monitoring but do not, on the evidence in this alert, indicate a pattern specific to this counterparty or transfer that would warrant escalation.

{
  "n": 1182,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.985,
  "routeReason": "detector not auto-closable"
}