Transaction Risk Skoor 55 (review band) on a $530.17 ach transfer: returns.counterparty_prior_unauthorized, geo.outside_declared_countries.

What happened. Alert a78b85ba-cd8b-402a-9f2f-c65adfb717ee was opened on 2026-09-17T19:32:15.226Z by the skoor_review detector for a $530.17 outgoing ACH credit (acht_sim_harb_52c7gytl9bm) under the Harbor Marketplace Payouts program. The transaction risk skoor was 55, placing it in the review band, with hard_signal false and route reviewed because the detector is not auto-closable. What the evidence shows. The skoor of 55 was driven by two signals: returns.counterparty_prior_unauthorized (weight 40, detail: 2 prior unauthorized returns for this counterparty) and geo.outside_declared_countries (weight 15, counterparty country AE, while the program's declared countries are US only). The transfer itself is already SETTLED with no return code recorded. The counterparty is cpty_sim_harb_1fd2i6t54k3 in AE. The originating entity, Reconciliation Agent (Harbor), is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-08-21. Program KRIs show ach_unauthorized_return_rate at 0.0082 (n=858) in breach status and manual_review_aging_hours at 1438 hours (n=16) also in breach status, alongside several KRIs in watch status (hold_aging_hours, overdraft_events, card_fraud_declines, pep_flagged_entities, high_risk_entity_share). No prior dispositions exist for this alert or counterparty in the record provided. What was checked. Reviewed the alert evidence and weighted signals, the transfer record (status, amount, rail, counterparty, return code), the program's declared rails/countries/volume, the originating entity's verification and screening status, and the program-level KRI snapshot. No return code is present on this transfer despite the counterparty's history of prior unauthorized returns, and no prior dispositions exist to compare against. What is recommended. The transfer has already settled, so there are no funds to hold on this transaction. However, the combination of a counterparty with two prior unauthorized returns, an out-of-declared-country counterparty (AE vs. declared US), and program-level KRI breaches in ach_unauthorized_return_rate and manual_review_aging_hours indicates a pattern that extends beyond this single alert. This should be escalated for a person to assess whether the counterparty relationship and the program's country/return-rate exposure warrant broader action (e.g., counterparty review, program-level controls), rather than closing the alert on the strength of a single settled transaction.

{
  "n": 2165,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "geo.outside_declared_countries",
      "detail": "counterparty country AE not declared by the program",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}