Transaction Risk Skoor 40 (review band) on a $727.79 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert c927e0bc-2963-4a3e-9a45-26c140bc2515 fired on a $727.79 outgoing ACH transfer (acht_sim_lant_4ujoeslje00) under Lantern Lending. The skoor_review detector scored the transfer 40, placing it in the review band, based on a single signal: the counterparty has 1 prior unauthorized return on record. What the evidence shows. The transfer itself settled with no return code, meaning this specific transaction did not fail or get reversed. The skoor is driven entirely by one signal (returns.counterparty_prior_unauthorized, weight 40) reflecting one prior unauthorized return tied to the counterparty (country unknown). Hard_signal is false, meaning no current-transaction rule violation. The originating entity, Alder Co 30, is a verified business, not flagged high risk, not PEP, has no open review reasons, and was screened 2026-06-27. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=190) and ach_overall_return_rate at 0.0105 (n=190), both in the ok range, indicating no broader return pattern at the program level. Two KRIs are outside ok: hold_aging_hours (watch) and manual_review_aging_hours (breach), and pep_flagged_entities is at watch (1 of 33). None of these three are tied to this transfer or this counterparty in the evidence provided. What was checked. Reviewed the transfer status and return code, the single signal driving the skoor, the entity's verification and risk flags, program-level return-rate KRIs, and prior dispositions on this subject. Prior dispositions: none on file. What is recommended. The transfer has already settled; there is no held transfer to act on, so release does not apply. Given a single historical unauthorized-return data point on the counterparty, no current-transaction violation, a verified low-risk originating entity, and program-level return rates within normal range, the evidence does not show a pattern requiring escalation. Close the alert. Note for the record that manual_review_aging_hours is in breach at the program level; this is a program-wide operational issue and not specific to this alert, so it should be tracked separately rather than held against this disposition.

{
  "n": 571,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.985,
  "routeReason": "detector not auto-closable"
}