Transaction Risk Skoor 40 (review band) on a $968.01 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert a5f127cd-8d79-4d6f-ad8f-cb2fb9be0eb8 was opened by the skoor_review detector on an outgoing ACH transfer of $968.01 (acht_sim_lant_35c3xmzle3c) under program Lantern Lending. The transfer scored 40 (review band) driven by a single signal: the counterparty has 1 prior unauthorized return on record. What the evidence shows. The transfer is SETTLED with no return code, meaning this specific transfer completed without any authorization dispute. The risk score was driven entirely by one signal (returns.counterparty_prior_unauthorized, weight 40) with no hard signal present (hard_signal: false). The counterparty's country is unknown, but the receiving entity (Birch Holdings 313) is VERIFIED, not high risk, not PEP, with no review reasons and a recent screening date (2026-07-06). Program-level KRIs show ach_unauthorized_return_rate at 0 (n=219, ok) and ach_overall_return_rate at 0.0137 (n=219, ok), indicating no broader pattern of unauthorized or problematic returns across the program. Manual_review_rate (0.0114, n=525) and high_risk_entity_share (0.0303, n=33) are both within ok range. Two KRIs are flagged watch/breach (hold_aging_hours watch, manual_review_aging_hours breach) but these reflect program-level review-queue timing, not evidence specific to this transfer. What was checked. Transfer status and return code, entity verification and screening status, program KRIs for unauthorized/overall return rates and entity risk share, and prior dispositions on this alert (none found). What is recommended. No return occurred on this transfer and the counterparty's single prior unauthorized return is not corroborated by any program-level uptick in unauthorized returns. The receiving entity is verified and unflagged. Because the transfer already settled, there are no funds to hold, and there is no evidence of a broader pattern warranting escalation. This can be closed on the evidence presented.

{
  "n": 637,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.955,
  "routeReason": "detector not auto-closable"
}