Transaction Risk Skoor 40 (review band) on a $768.61 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert flagged a settled $768.61 ACH outgoing transfer (acht_sim_harb_b2t7vo2l8xw) under program Harbor Marketplace Payouts. The detector skoor_review scored the transfer at 40 (review band) based on one signal: the counterparty has a prior unauthorized return on record. What the evidence shows. The transfer settled with no return code on this transaction itself. The only signal driving the score is 'returns.counterparty_prior_unauthorized' (weight 40, detail: 1 prior unauthorized return), which alone reached the review band threshold. Hard signal is false. The counterparty's country is unknown, but the paying entity, Birch Holdings 113, is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-08-19. There are no prior dispositions on record for this entity or counterparty. What was checked. Transfer status and return code, entity verification and risk flags, screening recency, and program KRIs. Program-level KRIs show ach_unauthorized_return_rate at 0.0076 flagged as a breach and manual_review_aging_hours at 1438 hours flagged as a breach; other KRIs (frozen accounts, velocity vs declared, sanctioned country transfers, reserve coverage) are in ok or watch range. Nothing in the evidence links this specific transfer to the KRI breaches beyond both concerning ACH unauthorized returns generally. What is recommended. This transfer is already settled, so it is not eligible for a hold or release action. The evidence for this alert is a single historical unauthorized return on the counterparty with no current return code, no hard signal, and a verified low-risk paying entity. Nothing here requires further transfer-level action. Recommend closing this alert. Separately, a person should review whether the program-wide ach_unauthorized_return_rate and manual_review_aging_hours breaches warrant a broader look, but that is outside the scope of this single alert.

{
  "n": 2003,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}