Transaction Risk Skoor 30 (review band) on a $625.27 ach transfer: returns.counterparty_prior_any, returns.entity_rate_gt_threshold.

What happened. An ACH outgoing credit transfer of $625.27 from program Harbor Marketplace Payouts, associated with entity Dune LLC 115 (counterparty cpty_sim_harb_39i9ftby3xi), was returned under code R05. The skoor_review detector scored this transfer 30 (review band) and generated an alert because two signals fired: a prior-returns signal and an entity-return-rate-threshold signal. What the evidence shows. The transfer itself has already settled as RETURNED, so no funds are currently pending or held on this transaction. The alert evidence shows two signals: 2 prior returns other than NSF for this counterparty (weight 15), and an entity unauthorized return rate of 1/27 (about 3.7%) on originated ACH debits in the trailing 60 days (weight 15), combining to the review-band skoor of 30. Hard signal is false and detector confidence is 1 at n=1733. The entity Dune LLC 115 is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-08-16. At the program level, the KRI panel shows ach_unauthorized_return_rate at 0.00912 flagged as a breach (n=877), and manual_review_aging_hours at 1438 hours also flagged as a breach (n=16). Other KRIs (frozen_accounts, overdraft_events, card_fraud_declines, high_risk_entity_share, pep_flagged_entities) are in watch or ok status. There are no prior dispositions on this alert. What was checked. Transfer status and return code, entity verification and screening status, program KRI panel, and prior disposition history. No counterparty entity profile beyond the ID was provided, and counterparty country is listed as unknown. What is recommended. Because the transfer has already settled as returned, there is no transfer to hold or release. However, the combination of this entity's repeat return history, its individual return-rate signal, and the program-level breach on ach_unauthorized_return_rate and manual_review_aging_hours suggests this alert may be one instance of a broader pattern rather than an isolated event. This warrants escalation for a person to review whether the entity or program-level return trend requires a wider look across other transfers, rather than closing the single alert on its own facts.

{
  "n": 1733,
  "band": "review",
  "skoor": 30,
  "signals": [
    {
      "code": "returns.counterparty_prior_any",
      "detail": "2 prior return(s) other than NSF",
      "weight": 15
    },
    {
      "code": "returns.entity_rate_gt_threshold",
      "detail": "entity unauthorized return rate 1/27 originated ACH debits in 60d",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}