Transaction Risk Skoor 40 (review band) on a $628.36 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert ae03e63f-7f4d-4d77-823b-c624ed37318a fired on outgoing ACH transfer acht_sim_harb_bbslsie66g for $628.36, already SETTLED, under the Harbor Marketplace Payouts program. The detector skoor_review scored the transfer 40 (review band) based on one prior unauthorized return recorded against the counterparty (signal returns.counterparty_prior_unauthorized, weight 40, confidence 1, n=805). What the evidence shows. The transfer itself carries no return code and settled normally. The originating entity, Elm Partners 116, is VERIFIED, not flagged high risk, not PEP, and was screened as recently as 2026-06-23. The only adverse signal is the counterparty's single prior unauthorized return; the counterparty's country is unknown, and no further counterparty history is provided. At the program level, ach_unauthorized_return_rate is flagged as a breach (0.85%, n=236) and manual_review_aging_hours is also a breach (1438 hours average, n=5), while pep_flagged_entities (1/30) and high_risk_entity_share (6.7%) are at watch. Other KRIs (frozen_accounts, overdraft_events, sanctioned_country_transfers, reserve_coverage_ratio, administrative_return_rate, concentration) are within normal range. What was checked. Reviewed the transfer record, the single risk signal and its weight/confidence, the entity's verification and screening status, and the full set of program KRIs for corroborating or contradicting patterns. No prior dispositions exist for this alert or entity. What is recommended. The transfer has already settled, so there is no fund movement to hold or release. The individual alert evidence (one prior unauthorized return, verified low-risk entity) is not on its own sufficient to require further account-level action. However, the program-level breach in ach_unauthorized_return_rate combined with the manual_review_aging_hours breach indicates the review queue is running behind and unauthorized-return incidence is above the program's own threshold. This combination suggests the pattern extends beyond this single alert and should be escalated for a program-level look at unauthorized-return handling and review backlog, rather than closed as an isolated item.

{
  "n": 805,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}