SKOOR Risk Money movement. Skoored by AI.

Alert · reviewed · open

The entity's first transfer, $2,318.16, above the program median, came 0.0 hours after verification.

Detector
rapid_onboarding
Severity
medium
Program
Northwind Payroll (simulated)
Subject
transfer acht_sim_nort_c9ci8wmx6y
Transfer
acht_sim_nort_c9ci8wmx6y · $2,318.16 · ach outgoing
Skoor at alert
null unscored
Hard signal
no
Policy
policy-v1
Opened
2026-09-17 19:30Z
Closed
Decision clock
none · due — no clock
Escalated

Draft narrative

What happened. Alert a5709cdc-19e0-4ed5-9bca-edae45c9a2b7 fired on detector rapid_onboarding for transfer acht_sim_nort_c9ci8wmx6y under Northwind Payroll. The transfer is the entity's first, an outgoing ACH credit of $2,318.16, initiated 0.0 hours after verification, above the program median of $1,816.59. What the evidence shows. The transfer status is SETTLED with no return code. The transfer-level skoor is null, band unscored, n=2, confidence null, indicating too few data points to score. The entity enti_sim_nort_60saz5iv1m is VERIFIED, not high risk, not PEP, with no review reasons and a screening date of 2026-07-03. The counterparty's country is listed as unknown but there is no return, no hold, and no other adverse field. There are no prior dispositions on this entity. What was checked. Reviewed the alert evidence block (thresholds, median, hours since verification), the transfer record (status, amount, rail, return code), the program declared volume ($2,500,000.00/month, which a $2,318.16 transfer is well within), and the entity record (verification status, risk flags, screening history). No scoring signal is available at either the transfer or entity level to corroborate elevated risk beyond the timing pattern itself. What is recommended. The transfer has already settled, so a hold or release is not applicable. The only signal present is rapid timing relative to verification, which the detector is built to flag categorically; there is no scoring support, no risk flag, no PEP hit, and no prior disposition history to suggest a broader pattern. Absent additional evidence, this does not require further review by a person and can be closed. If a second rapid, above-median transfer occurs from this entity, the pattern should be escalated at that point given the still-thin n=2 evidence base.
Recommendation
close
Confidence
0.62
Model
claude-sonnet-5
Drafted
2026-09-17 19:30Z
Rationale
  • Transfer status is SETTLED; no return code; no funds-movement decision remains for a person to make.
  • Entity is VERIFIED, not high risk, not PEP, with no review reasons on file.
  • Scoring is unavailable (skoor null, band unscored, confidence null, n=2), meaning the alert rests solely on the timing/amount rule with no corroborating risk signal.
  • Transfer amount ($2,318.16) is a small fraction of the program's declared monthly volume ($2,500,000.00), consistent with a normal payroll-program transaction.
  • No prior dispositions exist on this entity, so there is no established pattern across alerts to justify escalation.
  • Counterparty country is unknown, which is a minor gap but not paired with any other adverse indicator in the evidence provided.

Evidence

{
  "n": 2,
  "band": "unscored",
  "skoor": null,
  "typology": "rapid_onboarding",
  "confidence": null,
  "thresholds": {
    "hours": 24
  },
  "medianCents": "181659",
  "routeReason": "detector not auto-closable",
  "hoursSinceVerification": 0
}

Decision

Sign in as an operator to decide. Operator sign-in →

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.