Transaction Risk Skoor 40 (review band) on a $612.82 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert e58b87a0-b654-4b0a-bfc5-66cb91d0672b fired on transfer acht_sim_lant_2m2tkhg0d4w, a $612.82 outgoing ACH debit under program Lantern Lending. The skoor_review detector scored the transfer 40, landing in the review band, driven by a single signal: the counterparty has one prior unauthorized return on record. What the evidence shows. The transfer itself settled with no return code, meaning this specific transaction was not returned or flagged as unauthorized. The subject entity, Cedar Services 32, is a verified US person with no high-risk flag, no PEP status, no open review reasons, and screening current as of 2026-06-23. Program-level KRIs show ach_unauthorized_return_rate at 0 across n=54 transfers and ach_overall_return_rate at 0, indicating no active pattern of unauthorized returns in this program. The only elevated program metric is manual_review_aging_hours in breach (n=2) and hold_aging_hours in watch (n=1), which relate to review queue timing, not to this transaction's risk. What was checked. Transfer status and return code, entity verification and screening status, program-level return-rate and risk-concentration KRIs, and prior dispositions for this alert (none on file). The evidence set is limited to one signal at weight 40 with confidence 0.79 on n=220; no additional signals, sanctions hits, or velocity anomalies are present in the record. What is recommended. The transfer has already settled, so there is no held transaction to release. The single driving signal is a historical counterparty return, not a current unauthorized return or entity risk finding, and program-wide unauthorized-return metrics show 0. Given verified entity status and absence of any current negative outcome on this transfer, no further action is needed on this alert; a reviewer should confirm the counterparty's prior unauthorized return does not recur before closing.

{
  "n": 220,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.79,
  "routeReason": "detector not auto-closable"
}