Transaction Risk Skoor 40 (review band) on a $1,870.59 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert 923c88b7-1ce6-425c-9b49-ba9a40209c2d fired on transfer acht_sim_nort_84fozigd2do, an outgoing ACH debit of $1,870.59 under program Northwind Payroll. The transaction risk skoor was 40, placing it in the review band, driven by a single signal: the counterparty has 1 prior unauthorized return on record. What the evidence shows. The transfer itself is SETTLED with no return code, meaning this specific transaction cleared without incident. The skoor of 40 comes entirely from one historical signal (returns.counterparty_prior_unauthorized, weight 40) and hard_signal is false. The counterparty's country is unknown, but the originating entity, Reconciliation Agent (Northwind), is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-06-28. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=338) and overall ach_return_rate at 1.18% (n=338), both in the ok range, indicating this counterparty's prior unauthorized return is not part of a broader pattern across the program. Manual_review_aging_hours shows a breach (1434.7 hours, n=7), but this is a program-wide backlog metric unrelated to this specific counterparty or transfer. There are no prior dispositions on this subject. What was checked. Transfer status and return code, skoor composition and signal weight, entity verification and screening status, program KRIs for unauthorized return rate, sanctioned country exposure, velocity vs declared volume, and prior dispositions on this subject. What is recommended. Close the alert. The transfer settled cleanly with no return, the entity is verified with no other risk flags, and program-level unauthorized return metrics show no corroborating pattern. The single prior unauthorized return on the counterparty is noted but does not, on its own, indicate current risk requiring a hold. The manual_review_aging_hours breach is a separate program-level condition that should be tracked outside this alert.

{
  "n": 877,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}