Transaction Risk Skoor 55 (review band) on a $1,220.20 ach transfer: returns.counterparty_prior_unauthorized, returns.entity_rate_gt_threshold.

What happened. An ACH outgoing debit of $1,220.20 from Northwind Payroll (simulated) to counterparty cpty_sim_nort_25c8izfo4a settled on 2026-09-02. The transfer scored 55 (review band, hard_signal false) on two signals: a prior unauthorized return associated with this counterparty (weight 40) and the originating entity's unauthorized return rate exceeding the program threshold (weight 15, detail 1/27 originated ACH debits in 60 days). What the evidence shows. The transfer is already SETTLED with return code none, meaning no return has been filed against this specific transfer. The counterparty-level signal cites one prior unauthorized return (not on this transfer). The entity-level signal reflects a 3.7% (1/27) unauthorized return rate in the trailing 60 days, above the program threshold. The originating entity, Grove Co 018, is VERIFIED, not flagged high risk, not PEP, has no review reasons, and was screened 2026-07-07. Program KRIs show ach_unauthorized_return_rate at 0 (n=481, ok) and ach_overall_return_rate at 1.25% (n=481, ok), both within normal range, indicating this single prior return has not translated into a broader program-level return problem. Two KRIs are flagged watch (pep_flagged_entities, high_risk_entity_share) and one is flagged breach (manual_review_aging_hours=1434.7h, n=10), but none of these tie directly to this entity or this transfer. What was checked. Transfer status and return code, entity verification and screening status, program declared volume versus transfer size, prior dispositions (none on record), and program-level KRIs for unauthorized/overall return rates and review aging. What is recommended. This transfer already settled with no return filed against it, so there is no fund movement to hold or release. The entity is verified with no other adverse indicators, and program-wide unauthorized return rate remains at 0%, suggesting the single prior counterparty return has not developed into a broader pattern. Close this alert. Note for the record that the entity's 60-day unauthorized return rate (1/27) is above threshold and should be revisited if a second unauthorized return occurs for this entity or counterparty.

{
  "n": 1130,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "returns.entity_rate_gt_threshold",
      "detail": "entity unauthorized return rate 1/27 originated ACH debits in 60d",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}