Transaction Risk Skoor 40 (review band) on a $264.41 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An ACH outgoing transfer of $264.41 from entity Fern Studio 15 (program Harbor Marketplace Payouts) was flagged by the skoor_review detector at a risk score of 40, placing it in the review band. The single triggering signal is a prior unauthorized return associated with the counterparty. What the evidence shows. The evidence shows one signal: returns.counterparty_prior_unauthorized, weighted 40, described as '1 prior unauthorized return(s)' for counterparty cpty_sim_harb_gzii64r41f. The transfer itself settled with no return code, meaning this specific transfer was not returned. The entity Fern Studio 15 is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-07-02. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=99, ok) and ach_overall_return_rate at 0 (n=99, ok), indicating no broader unauthorized-return pattern at the program level. Two KRIs are flagged watch (pep_flagged_entities=1 of 30, high_risk_entity_share=0.067) and one is a breach (manual_review_aging_hours=1438.02 hours, n=2), but none of these tie directly to this entity or this counterparty. There are no prior dispositions on this alert. What was checked. Checked the transfer status (SETTLED, no return code), entity verification status and screening date, program declared volume and rails, and program-level KRI panel for return-rate and concentration patterns. Checked for prior dispositions (none found). The counterparty's country is listed as unknown, and no additional detail on the prior unauthorized return (date, amount, or count beyond '1') is provided in the evidence. What is recommended. This transfer already settled and is not a held transfer, so no release action applies. The evidence is limited to a single prior unauthorized return on the counterparty with no further detail, and the entity itself carries no other risk indicators. Given the counterparty has a documented prior unauthorized return, a person should review the counterparty relationship before this or future transfers to the same counterparty, but nothing here shows a broader pattern warranting escalation. Recommend hold for review of the counterparty relationship rather than close, since the underlying concern (counterparty's unauthorized return history) has not been addressed by a person.

{
  "n": 483,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}