Transaction Risk Skoor 55 (review band) on a $471.54 ach transfer: returns.counterparty_prior_unauthorized, geo.outside_declared_countries.

What happened. Alert a304a788-b881-48f5-bb99-b7df33987a46 fired on outgoing ACH transfer acht_sim_harb_b1pcwy5998j, a $471.54 debit from Harbor Marketplace Payouts to counterparty cpty_sim_harb_7nn77rms57g. The transfer scored 55 (review band) on two signals: 4 prior unauthorized returns tied to this counterparty (weight 40) and a counterparty country (TR) outside the program's declared country list of US only (weight 15). The transfer has already settled with no return code recorded. What the evidence shows. The counterparty has a documented history of 4 unauthorized returns, which is a specific and material red flag distinct from a one-off return. The transfer moved to a country (TR) the program never declared, meaning this payout falls outside the program's stated geographic scope. The originating entity, Heath Holdings 17, is verified, not high-risk, not PEP, and screening is current (last screened 2026-08-27), so the alert is not about the sender's identity risk. Program-level KRIs show ach_unauthorized_return_rate at 0.00816 flagged as breach and manual_review_aging_hours at 1438 flagged as breach, both out of tolerance. Other KRIs (frozen_accounts, overdraft_events, card_fraud_declines, pep_flagged_entities, high_risk_entity_share) sit in watch status. No prior dispositions exist for this alert or entity. What was checked. Reviewed the alert signals and weights, the transfer record (status SETTLED, return code none, amount, rail, dates), the program's declared countries and volume, the entity's verification and screening status, and the full program KRI panel. No hold flag is present on the transfer, and the route reason states the detector is not auto-closable. What is recommended. The transfer has already settled, so there are no funds to hold or release. However, the combination of a counterparty with 4 prior unauthorized returns, a transaction routed to an undeclared country, and program-level KRI breaches on ach_unauthorized_return_rate and manual_review_aging_hours indicates a pattern that extends beyond this single alert. This should be escalated for a person to review counterparty history and program geographic controls, rather than closed as a one-off.

{
  "n": 2151,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "4 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "geo.outside_declared_countries",
      "detail": "counterparty country TR not declared by the program",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}