Transaction Risk Skoor 40 (review band) on a $905.67 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An ACH outgoing debit transfer of $905.67 from program Northwind Payroll (simulated) was flagged by the skoor_review detector at Transaction Risk Skoor 40, placing it in the review band. The triggering signal is one prior unauthorized return associated with the counterparty. What the evidence shows. The transfer settled already (status SETTLED, return code none), so no unauthorized return occurred on this specific transaction. The alert is driven entirely by a single historical signal: returns.counterparty_prior_unauthorized, weighted 40, which alone accounts for the full skoor of 40. Confidence on this scoring is stated at 0.94 with n=781. The subject entity, Birch Holdings 01, is VERIFIED, not high risk, not PEP, has no review reasons, and was screened 2026-06-23. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=302, ok) and ach_overall_return_rate at 0.99% (ok), indicating this program does not show a broader unauthorized-return pattern. Two KRIs are flagged watch (pep_flagged_entities, high_risk_entity_share) and one is a breach (manual_review_aging_hours=1434.67 hours, n=7), but none of these are tied to this specific transfer or counterparty in the evidence provided. What was checked. Transfer status and return code, entity verification and screening status, program-level return-rate and risk KRIs, and prior dispositions (none on record for this alert). What is recommended. The transfer has already settled, so no funds are being held pending this alert; a hold or release action does not apply. The evidence is a single prior counterparty return event with no corroborating pattern at the program level (unauthorized return rate is 0) and a verified, non-high-risk subject. This does not meet the bar for escalation absent further pattern evidence, but the counterparty's prior unauthorized return and the elevated manual_review_aging_hours breach warrant a person's review before closing, particularly to confirm the counterparty history does not represent a recurring issue outside this single alert's scope.

{
  "n": 781,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.94,
  "routeReason": "detector not auto-closable"
}