The program's ach unauthorized return rate is 0.79% over 883 originated debits, above the 0.5% network threshold.

What happened. The return_rate_breach detector fired for program 898ba6ad-5b42-42fd-be7b-2afc9d52af5b (Harbor Marketplace Payouts) on 2026-09-18. The program's ACH unauthorized return rate over 883 originated debits is 0.79%, which exceeds the 0.5% network threshold. Route is 'reviewed' per the detector's always-review policy; severity is high. What the evidence shows. The evidence field confirms n=883, ach_unauthorized_return_rate=0.007927519818799546 (0.79%), status breach, threshold 0.005 (0.5%). The program KRI panel shows the same metric in breach and also shows manual_review_aging_hours=1387.15 hours (n=17) in breach, well above what the ok/watch bands imply. Related watch-level KRIs include hold_aging_hours=1028.7 hours (n=11), overdraft_events=1 (n=3), card_fraud_declines=1 (n=1), pep_flagged_entities=1 (n=30), and high_risk_entity_share=6.67% (n=30). ach_overall_return_rate is 2.60%, higher than the unauthorized-only figure, which is expected since unauthorized returns are a subset. Reserve coverage (1.11), verification denial rate (3.33%), sanctioned_country_transfers (0), and counterparty concentration (7.19%) are within ok range. There is no prior disposition on this program to indicate the breach has already been reviewed or explained. What was checked. Reviewed the alert evidence block, the full program KRI set, declared program volume and rails, and prior dispositions. Confirmed the unauthorized return rate breach is corroborated by a separate breach in manual_review_aging_hours and by several watch-level indicators (hold aging, overdraft events, card fraud declines, PEP-flagged entities, high-risk entity share). Confirmed the alert score is null (unscored) and hard_signal is false, meaning no automated high-confidence signal has already validated this as escalation-worthy. Confirmed this alert concerns a program-level rate metric, not a specific held transfer, so no funds are currently on hold for this alert. What is recommended. A person should review the program's ACH return activity and the aging manual-review queue before this reaches the next reporting cycle, given the network threshold breach is paired with a second breach (manual_review_aging_hours) and multiple watch-level indicators on the same program. This combination suggests a pattern across program controls rather than an isolated metric spike, warranting escalation beyond a routine single-alert review.

{
  "n": 883,
  "kri": "ach_unauthorized_return_rate",
  "unit": "ratio",
  "value": 0.007927519818799546,
  "status": "breach",
  "threshold": 0.005,
  "routeReason": "detector always reviewed"
}