Alert · reviewed · open

Transaction Risk Skoor 40 (review band) on a $792.55 ach transfer: returns.counterparty_prior_unauthorized.

Detector: skoor_review
Severity: medium
Program: Lantern Lending (simulated)
Subject: transfer acht_sim_lant_4xru793vdbw
Transfer: acht_sim_lant_4xru793vdbw · $792.55 · ach outgoing
Skoor at alert: 40 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:30Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An ACH outgoing credit transfer of $792.55 from Lantern Lending program was flagged by the skoor_review detector at a risk score of 40 (review band), driven by a single signal: the counterparty has one prior unauthorized ACH return on record. What the evidence shows. The transfer itself settled with no return code, indicating this specific transaction cleared without incident. The counterparty's country is unknown, but the originating entity, Lantern Lending, is a verified business, not high risk, not PEP, with no open review reasons and screening current as of 2026-07-23. Program-level KRIs show ach_unauthorized_return_rate at 0 (n=83) and ach_overall_return_rate at 0 (n=83), with no sanctioned country transfers (n=183) and low counterparty concentration (top1 at 0.18). The only elevated program metrics are hold_aging_hours (watch, n=1) and manual_review_aging_hours (breach, n=3), which reflect review queue timing rather than this transfer's risk profile. What was checked. Transfer status and return code, entity verification and screening status, program-level return-rate and concentration KRIs, and prior dispositions for this subject. No prior dispositions exist for this alert. What is recommended. The transfer has already settled with no return, and program-wide return rates show no pattern of unauthorized returns beyond the single historical flag on this one counterparty. There is no indication of a broader issue requiring escalation, and no funds are currently held pending this alert. A person should confirm the counterparty's single prior unauthorized return does not represent an emerging pattern before final sign-off, but the evidence as presented does not require holding funds or escalating.

Recommendation

Confidence

0.62

Model

claude-sonnet-5

Drafted

2026-09-17 19:31Z

Rationale

Single signal (returns.counterparty_prior_unauthorized) drove the review-band score; no hard signal flag was set.
This transfer settled with return code none, so the flagged history did not repeat on this transaction.
Entity is verified, not high risk, not PEP, and screening is current.
Program-wide ach_unauthorized_return_rate is 0 across n=83, showing no pattern that would support escalation.
Transfer is already settled, so 'hold' or 'release' framing does not apply; no funds are pending action.
Confidence is capped below high because counterparty country is unknown and the underlying prior unauthorized return detail (date, amount, program) is not provided in this context.

Evidence

{
  "n": 290,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 0.88,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_unauthorized	+40		1 prior unauthorized return(s)

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.