Transaction Risk Skoor 55 (review band) on a $602.44 ach transfer: returns.counterparty_prior_unauthorized, returns.entity_rate_gt_threshold.

What happened. Alert ce1186eb-3d6a-4b8c-8836-11350b0b81ae fired on ach transfer acht_sim_harb_253holxp93x, a $602.44 outgoing ACH credit under Harbor Marketplace Payouts. The transfer risk score was 55 (review band, not hard-stop) driven by two signals: the counterparty has 2 prior unauthorized returns, and the entity's unauthorized return rate (1/29 originated ACH debits in 60d) exceeds the configured threshold. The transfer itself settled on 2026-09-11 with no return code recorded. What the evidence shows. The transfer status is SETTLED with return code none, meaning funds already moved and no return has posted against this specific transfer. The originating entity, Larch Studio 111, is VERIFIED, not flagged high risk, not PEP, and was screened as recently as 2026-08-21 with no open review reasons. The risk signals relate to counterparty and entity return history rather than this transfer's own outcome. At the program level, the ach_unauthorized_return_rate KRI is listed in breach status (0.00862, n=812), and pep_flagged_entities, high_risk_entity_share, and overdraft_events are all in watch status. Manual_review_aging_hours is also in breach (1438 hours, n=15). No prior dispositions exist for this alert or entity. What was checked. Reviewed the transfer record (status, return code, amount, counterparty), the entity verification and screening record, the alert's underlying signal weights and confidence, and the program-level KRI panel for corroborating patterns. Confirmed there is no hard signal on this alert and no prior dispositions to reference. What is recommended. Because this transfer has already settled with no return, there are no funds to hold and release does not apply. However, the combination of a counterparty with two prior unauthorized returns, an entity-level return rate above threshold, and a program-wide breach on ach_unauthorized_return_rate together indicate a pattern that extends beyond this single alert. This warrants escalation for a person to assess whether the counterparty or entity requires broader review across other transfers, rather than a routine close.

{
  "n": 2045,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "returns.entity_rate_gt_threshold",
      "detail": "entity unauthorized return rate 1/29 originated ACH debits in 60d",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}