Transaction Risk Skoor 40 (review band) on a $230.57 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert bc2711c3-e671-437c-b584-36e45aa42463 was generated by the skoor_review detector on an outgoing ACH transfer (acht_sim_harb_4x373e5n8nd) of $230.57 from the Harbor Marketplace Payouts program. The transfer risk score was 40, placing it in the review band, driven entirely by one signal: the counterparty has one prior unauthorized ACH return. What the evidence shows. The transfer is outgoing, has settled, and carries no return code, meaning no funds are in a held or reversible state. The subject entity, Heath Holdings 119, is verified, not flagged high risk, not a PEP, has no open review reasons, and was screened on 2026-09-01. The single signal contributing to the score is one prior unauthorized return on the counterparty, weighted at 40 out of a possible higher band; there is no additional signal stacking. Program-level KRIs show ach_unauthorized_return_rate and manual_review_aging_hours in breach status, and pep_flagged_entities, high_risk_entity_share, hold_aging_hours in watch status, but none of these are tied to this specific transfer or entity beyond the single counterparty return already reflected in the score. There are no prior dispositions on this alert. What was checked. Transfer status and return code, entity verification and risk flags, screening recency, signal composition and weighting, program KRI panel for corroborating pattern, and prior disposition history. What is recommended. Close the alert. The transfer has already settled with no return code, so there is no fund-holding decision to make. The only driver of the score is one historical unauthorized return on the counterparty, and the subject entity is verified with no other risk indicators. The program-level KRI breaches (ach_unauthorized_return_rate, manual_review_aging_hours) are noted for portfolio monitoring but are not evidenced as connected to this specific transfer or entity, so they do not support escalation on this alert alone.

{
  "n": 1848,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}