Transaction Risk Skoor 40 (review band) on a $488.15 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert c8ba602f-cc00-47a6-a815-b8eda344cbca fired on outgoing ACH transfer acht_sim_harb_x17u1xl900, a $488.15 debit under the Harbor Marketplace Payouts program. The skoor_review detector scored the transfer 40 (review band, hard_signal false) on the single signal returns.counterparty_prior_unauthorized, weight 40, citing 2 prior unauthorized returns for the counterparty. The transfer status is SETTLED with return code none; the alert was auto-routed to review because the detector is not auto-closable. What the evidence shows. The counterparty cpty_sim_harb_27gwzr6k4hg has a documented history of 2 prior unauthorized returns, which is the sole driver of the score. The transfer itself settled cleanly with no return code, so no loss or reversal has occurred on this specific transaction. The originating entity, Payout Agent (Harbor), is VERIFIED, not high risk, not PEP, and was screened 2026-09-02 with no open review reasons. Program-level KRIs show ach_unauthorized_return_rate at 0.86% (n=812) flagged as a breach, and manual_review_aging_hours at 1438 hours (n=15) also flagged as breach. Other KRIs (overall return rate, administrative return rate, velocity vs declared, concentration) are within ok/watch ranges. No prior dispositions exist for this alert. What was checked. Reviewed the alert evidence and signal detail, transfer record (status, amount, return code, counterparty), entity verification and screening status, and the program KRI panel for corroborating or contradicting signals. No hold is in place on this transfer (status SETTLED), so there is no fund-movement decision pending on this alert. What is recommended. Because the transfer has already settled, there is no transfer to hold or release. The unauthorized-return history on this specific counterparty, combined with the program-wide breach on ach_unauthorized_return_rate, indicates this may not be an isolated counterparty issue but part of a broader pattern within the program. A person should review the counterparty's full transaction history across the program and the breach on manual_review_aging_hours to determine whether this counterparty or a related set of counterparties should be restricted from future payouts.

{
  "n": 2034,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}