Transaction Risk Skoor 55 (review band) on a $376.50 ach transfer: returns.counterparty_prior_unauthorized, returns.entity_rate_gt_threshold.

What happened. Alert acb39615-246c-410b-9d79-4f17009d44b4 fired on outgoing ACH credit (payout) acht_sim_harb_90w3r1nj8tf for $376.50 from program Harbor Marketplace Payouts to counterparty cpty_sim_harb_362c8piz3xi. The transaction risk score was 55 (review band, hard signal false), driven by two signals: one prior unauthorized return for this counterparty (weight 40) and an entity-level unauthorized return rate of 1/42 originated ACH debits in 60 days exceeding threshold (weight 15). What the evidence shows. The transfer is a CREDIT, status SETTLED, with no return code recorded, so the funds have already moved and no return has occurred on this transfer itself. The entity (Juniper LLC 19) is VERIFIED, not flagged high risk, not PEP, with no open review reasons and a screening date of 2026-09-03, before the transfer's creation. The entity-level unauthorized return rate cited (1/42) reflects the entity's ACH debit activity, not this credit transfer, and is a single historical occurrence. Program KRIs show ach_unauthorized_return_rate and manual_review_aging_hours in breach status, but these are program-wide metrics (n=767 and n=14 respectively) not specific to this entity or counterparty, and no prior dispositions exist tying this alert to a broader pattern. What was checked. Transfer status and return code, entity verification and screening status, program KRI panel, and prior dispositions for this alert or related entity. No return has posted against this transfer, and no other alerts on this entity are on record. What is recommended. Close the alert. The transfer has settled with no return, the entity is verified with no open risk flags, and the underlying signals reference a single historical counterparty return and a low entity return rate that do not, on this evidence, indicate an active or escalating problem tied to this specific transfer. The program-level KRI breaches (ach_unauthorized_return_rate, manual_review_aging_hours) are noted for separate program-level monitoring but are not evidenced here as connected to this entity or transfer.

{
  "n": 1951,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "returns.entity_rate_gt_threshold",
      "detail": "entity unauthorized return rate 1/42 originated ACH debits in 60d",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}