Transaction Risk Skoor 40 (review band) on a $240.94 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert ca0c1310-ccc4-4d6e-adf4-caa3a7b4af1e was opened on 2026-09-17 for an outgoing ACH credit transfer (acht_sim_harb_b4ftxtav8wn) of $240.94 under the Harbor Marketplace Payouts program. The transfer risk score (skoor) was 40, placing it in the review band, driven by a single signal: the counterparty has 2 prior unauthorized returns. What the evidence shows. The transfer itself settled with no return code, meaning no unauthorized return occurred on this specific transaction. The counterparty (cpty_sim_harb_39i9ftby3xi) has an unknown country and a history of 2 prior unauthorized returns, which is the sole basis for the score. The originating entity, Alder Co 10, is a verified business with no high-risk flag, no PEP status, no open review reasons, and screening current as of 2026-09-05. Program-level KRIs show ach_unauthorized_return_rate at 0.0076 (n=793) is flagged as a breach, and manual_review_aging_hours (1438 hours, n=15) is also flagged as a breach. Other KRIs (velocity, concentration, sanctioned-country transfers, verification denial rate) are within normal range. What was checked. Reviewed the transfer status and return code, the entity's verification and screening status, the counterparty's return history as reflected in the signal, and the program's KRI panel for corroborating patterns. No prior dispositions exist for this alert. What is recommended. The transfer has already settled and there is no return on this transaction, so no funds are held or awaiting release. However, the program's ach_unauthorized_return_rate KRI is independently flagged as a breach, and this alert's own signal (counterparty with 2 prior unauthorized returns) is consistent with that program-level pattern. This combination suggests the counterparty-return issue may extend beyond this single alert and warrants a person to review whether other transfers to or from this counterparty, or similar counterparties, show the same pattern.

{
  "n": 1988,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}