Transaction Risk Skoor 40 (review band) on a $229.42 ach transfer: returns.counterparty_prior_unauthorized.

What happened. Alert ed9319ad-109d-42bc-b4f0-f19b49c8b7e1 was opened on 2026-09-17T19:30:20.139Z by the skoor_review detector for ACH transfer acht_sim_harb_5e7ozfuc4r0, a $229.42 outgoing credit under the Harbor Marketplace Payouts program. The transfer risk score is 40, placing it in the review band, driven by a single signal: one prior unauthorized return associated with the counterparty. What the evidence shows. The transfer itself settled with return code none, so no unauthorized return occurred on this transaction. The score of 40 comes entirely from the counterparty's history of one prior unauthorized return (weight 40), with confidence 1 on a sample of 233. The receiving entity, Alder Co 10, is VERIFIED, not high risk, not PEP, with no open review reasons and screening current as of 2026-07-04. Program KRIs show no frozen accounts, no overdraft events, a low verification denial rate (3.3%), and a high-risk entity share of 6.7% (watch level but based on n=30). Fields for ACH unauthorized return rate, hold aging, and manual review rate are unmeasured (null), so no program-wide return pattern can be confirmed from this data. What was checked. Transfer status and return code (SETTLED, no return), transfer-level skoor signal detail, entity verification status and screening date, and program KRI panel for related risk indicators (frozen accounts, overdraft, high-risk share, verification denial rate, unauthorized return rate). Prior dispositions on this alert: none. What is recommended. The transfer already settled with no return, and the flagged signal reflects a single historical unauthorized return by the counterparty rather than any issue with this transaction. The receiving entity is verified with no other risk flags. There is no evidence in the KRI panel of a broader unauthorized-return pattern (the relevant rate is unmeasured, not elevated). No transfer is currently held, so release does not apply. Based on the evidence provided, this alert does not require further hold action; a person should confirm closure given the single-signal basis.

{
  "n": 233,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "1 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}