Transaction Risk Skoor 40 (review band) on a $3,295.28 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 88e43ed7 fired on transfer acht_sim_nort_axqak8t02lb, a $3,295.28 outgoing ACH credit under Northwind Payroll, on the skoor_review detector. The transfer scored 40 (review band) due to one signal: returns.counterparty_prior_unauthorized, weighted 40, reflecting one prior unauthorized return on counterparty cpty_sim_nort_25c8izfo4a. No hard signal was present. What the evidence shows. The transfer itself is SETTLED with return code none, meaning it completed without issue. The originating entity, Cedar Services 02, is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened 2026-06-30. Program-level KRIs show ach_unauthorized_return_rate at 0 across n=417 transfers, counterparty_concentration_top1 at 10.4%, and velocity_vs_declared at 15.7%, all within normal range. The only KRI in breach is manual_review_aging_hours (1434.7 hrs, n=8), which reflects review queue timing, not this alert's substance. No prior dispositions exist for this subject. What was checked. Reviewed the transfer record (status, return code, amount, counterparty), the entity verification and risk flags, the program-level KRI panel for patterns in unauthorized returns or concentration, and prior dispositions history. Confirmed the alert's sole basis is a single historical unauthorized return on the counterparty, with no corroborating signal on this transaction or entity. What is recommended. The transfer has already settled with no return, the paying entity is verified and clean, and program-wide unauthorized return metrics show no pattern. There is nothing here requiring a hold on funds (already moved) or further investigation absent additional signals. Recommend closing the alert. A person should confirm no additional counterparty-level detail (e.g., date or amount of the prior unauthorized return) exists before final closure, since the evidence provided does not include it.

{
  "n": 956,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}