Transaction Risk Skoor 40 (review band) on a $247.11 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert e7e8a299-241e-4620-8f4c-af84ae9a044c fired on ACH outgoing transfer acht_sim_harb_4uqp7nrc8vp for $247.11, flagged by the skoor_review detector at skoor 40 (review band) due to one prior unauthorized return associated with the counterparty. Hard signal is false. The transfer itself settled with return code none. What the evidence shows. The only signal driving the score is returns.counterparty_prior_unauthorized, weighted 40, based on one historical unauthorized return for counterparty cpty_sim_harb_362c8piz3xi. This transfer, created 2026-09-09 and settled, carries no return code, indicating it processed without incident. The subject entity, Heath Holdings 119, is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-09-01. Program-level KRIs show ach_unauthorized_return_rate at 0.0076 (flagged breach) and manual_review_aging_hours at 1438 hours (flagged breach), but these are aggregate program metrics (n=793 and n=15 respectively) and are not specific to this counterparty or this transfer. No prior dispositions exist for this alert. What was checked. Reviewed the transfer record (status, amount, rail, return code), the entity verification and risk flags, the program KRI panel for related patterns, and prior disposition history. Confirmed the transfer is settled, not pending or held, so there are no funds in a holdable state. What is recommended. Close this alert. The transfer settled cleanly with no return, the entity is verified and low risk, and the triggering signal is a single historical unauthorized return rather than a recurring pattern tied to this counterparty. The program-level KRI breaches (ach_unauthorized_return_rate, manual_review_aging_hours) are aggregate signals that may warrant separate program-level review, but they do not point specifically to this transfer or this counterparty and should not block closure of this individual alert.

{
  "n": 1988,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}