Alert · reviewed · open

Transaction Risk Skoor 40 (review band) on a $283.14 ach transfer: returns.counterparty_prior_unauthorized.

Detector: skoor_review
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_bf6tm9ql9dw
Transfer: acht_sim_harb_bf6tm9ql9dw · $283.14 · ach outgoing
Skoor at alert: 40 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Alert 9fd8fb3c-a20c-470f-9ce1-cb1238851d81 flagged an outgoing ACH transfer of $283.14 (acht_sim_harb_bf6tm9ql9dw) under program Harbor Marketplace Payouts. The transfer risk score is 40, placing it in the review band. The triggering signal is returns.counterparty_prior_unauthorized, weighted 40, reflecting 5 prior unauthorized returns tied to the counterparty cpty_sim_harb_gzii64r41f. What the evidence shows. The transfer has already settled with no return code recorded. The paying entity, Fern Studio 117, is a verified US person with no high-risk flag, no PEP status, and no open review reasons; screening is current as of 2026-08-29. The only adverse signal is the counterparty's history of 5 unauthorized returns. Program-level KRIs show ach_unauthorized_return_rate at 0.91% flagged as a breach (n=877) and manual_review_aging_hours also in breach (1438 hours, n=16). Other KRIs (frozen accounts, overdraft, verification denial, sanctioned country transfers, counterparty concentration) are within normal ranges. What was checked. Reviewed the alert evidence, transfer status and metadata, the paying entity's verification and screening record, program KRIs, and prior dispositions. No prior dispositions exist for this alert. The transfer is settled, not held, so no funds are currently frozen pending this review. What is recommended. The transfer itself is settled and the paying entity carries no adverse flags, so there is no basis to hold funds that have already moved. However, the counterparty's 5 prior unauthorized returns combined with a program-wide breach-level ach_unauthorized_return_rate KRI indicates a pattern extending beyond this single transfer. This warrants review by a person to determine whether the counterparty relationship itself needs restriction or further monitoring across the program.

Recommendation

escalate

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer status is SETTLED with no return code; there is no held transfer to release or hold.
Paying entity is VERIFIED, not high risk, not PEP, with current screening and no open review reasons.
The sole risk signal is counterparty-level: 5 prior unauthorized returns, which is a repeated pattern rather than a one-off issue tied to this transfer.
Program KRI ach_unauthorized_return_rate is flagged as breach (0.91%, n=877), and manual_review_aging_hours is also in breach, suggesting broader program-level return and review-timeliness issues that a single alert closure would not address.
No prior dispositions exist to indicate this pattern has already been reviewed or addressed.
Confidence is moderated because the counterparty's country is unknown and no further detail on the nature or dates of the 5 prior unauthorized returns is provided in the evidence.

Evidence

{
  "n": 2184,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "5 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_unauthorized	+40		5 prior unauthorized return(s)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.