Transaction Risk Skoor 40 (review band) on a $1,923.12 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert e43642fe-15e8-4ac3-a1f7-5c74eac2bd79 fired on an outgoing ACH transfer (acht_sim_lant_c55n1n2fdq2) of $1,923.12 from Lantern Lending's Dune LLC 315 entity. The detector skoor_review scored the transaction at 40, placing it in the review band, driven entirely by one signal: the counterparty (cpty_sim_lant_asr3v7ggcjp) has one prior unauthorized ACH return on record. What the evidence shows. The transfer itself settled with no return code, meaning this specific transaction was not returned or disputed. The single signal contributing to the score (returns.counterparty_prior_unauthorized, weight 40) reflects the counterparty's history, not this transaction's outcome. The originating entity, Dune LLC 315, is VERIFIED, not high risk, not PEP, has no open review reasons, and was screened recently (2026-06-24). Program-level KRIs show ach_unauthorized_return_rate at 0 (ok, n=164) and ach_overall_return_rate at 1.2% (ok), with no elevated concentration on this counterparty (counterparty_concentration_top1=0.136, ok). Manual_review_aging_hours shows a breach (1433.6 hours, n=3), but this reflects program-wide review backlog, not evidence tied to this specific alert or counterparty. What was checked. Transfer status and return code, entity verification and risk flags, program KRIs for return rates and concentration, and prior dispositions for this alert or counterparty. No prior dispositions exist for this alert. No sanctioned-country or high-risk-entity flags apply. Confidence field on the skoor evidence is 1, and n=464 for the underlying model. What is recommended. The transfer has already settled and carries no return code, so there is no held transfer to release. The single risk signal traces to a historical counterparty return, not to any irregularity in this transaction, the entity, or program-level return metrics. Absent additional signals or a pattern across other alerts, this does not need further review.

{
  "n": 464,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}