Transaction Risk Skoor 40 (review band) on a $3,156.29 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert b5682646-fddb-47f1-998a-6f180483d104 fired on transfer acht_sim_nort_3mvvpc942c7, an outgoing ACH debit of $3,156.29 under the Northwind Payroll program. The transfer risk score (skoor) is 40, placing it in the review band, driven by a single signal: the counterparty (cpty_sim_nort_25c8izfo4a) has 1 prior unauthorized ACH return on file. What the evidence shows. The transfer itself is already SETTLED with no return code recorded, meaning it completed without being returned or flagged as unauthorized. The originating entity, Fern Studio 05, is VERIFIED, not high risk, not PEP, with no open review reasons and a screening date of 2026-07-05. The single contributing signal (returns.counterparty_prior_unauthorized, weight 40) accounts for the full skoor score; no other risk signals are present. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=338) and ach_overall_return_rate at 1.18% (n=338), both within normal range, indicating no broader pattern of unauthorized returns tied to this program. Two KRIs are flagged watch (pep_flagged_entities, high_risk_entity_share) and one is in breach (manual_review_aging_hours), but none of these connect to this specific transfer or counterparty. What was checked. Reviewed the transfer status and return code, the entity verification and risk profile, the single signal driving the skoor, and program-level KRIs for any pattern of unauthorized returns or elevated risk tied to this counterparty or program. No prior dispositions exist for this alert. What is recommended. Close the alert. The transfer has already settled with no return, the originating entity is verified with no other risk indicators, and program-level unauthorized return metrics are at zero, showing no pattern beyond the single historical signal on the counterparty. No further action is needed by a person before this alert can be closed; a person should still note the counterparty's prior unauthorized return for reference on any future transfers.

{
  "n": 859,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.895,
  "routeReason": "detector not auto-closable"
}