Alert · reviewed · open

Transaction Risk Skoor 55 (review band) on a $857.99 ach transfer: returns.counterparty_prior_unauthorized, returns.entity_rate_gt_threshold.

Detector: skoor_review
Severity: medium
Program: Harbor Marketplace Payouts (simulated)
Subject: transfer acht_sim_harb_4hsa0mhh9at
Transfer: acht_sim_harb_4hsa0mhh9at · $857.99 · ach outgoing
Skoor at alert: 55 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. An ACH outgoing credit transfer of $857.99 to counterparty cpty_sim_harb_39i9ftby3xi under the Harbor Marketplace Payouts program was flagged by the skoor_review detector at Transaction Risk Skoor 55 (review band). The transfer has already settled and carries no return code. What the evidence shows. Two signals drove the score: the counterparty has 2 prior unauthorized returns (weight 40), and the originating entity's unauthorized return rate is 1/25 (4%) over the trailing 60 days, above the configured threshold (weight 15). The transfer itself settled with no return code, so no unauthorized return has occurred on this specific transaction. The originating entity, Kestrel Partners 122, is VERIFIED, not high risk, not PEP, and was screened recently (2026-08-19). Program-level KRIs show ach_unauthorized_return_rate at 0.0082 flagged as a breach (n=858), and manual_review_aging_hours at 1438 hours also flagged as a breach (n=16). Other KRIs (frozen_accounts, overdraft_events, card_fraud_declines, pep_flagged_entities, high_risk_entity_share) are at watch level but not breach. Hard signal is false and confidence on the alert evidence is 1.0. What was checked. Transfer status and return code, entity verification and screening status, program KRI panel, and prior dispositions for this alert. No prior dispositions exist for this alert ID. What is recommended. This transfer has already settled with no return, so there is nothing to hold or release on this transaction. However, the combination of a repeat-offending counterparty (2 prior unauthorized returns), an entity return rate above threshold, and a program-wide breach on ach_unauthorized_return_rate suggests a pattern extending beyond this single alert. This warrants escalation for a person to review the counterparty and entity return history across the program rather than a routine close.

Recommendation

escalate

Confidence

0.60

Model

claude-sonnet-5

Drafted

2026-09-17 19:32Z

Rationale

Transfer status is SETTLED with return code none, so hold/release actions do not apply to this specific transaction.
Signal returns.counterparty_prior_unauthorized (2 prior unauthorized returns) indicates a recurring issue with this counterparty, not a one-off.
Signal returns.entity_rate_gt_threshold (1/25 = 4% unauthorized return rate) combined with the program KRI ach_unauthorized_return_rate flagged as breach (0.0082, n=858) suggests the entity's return behavior may be part of a broader program-level trend.
Entity verification, PEP, and screening status are all clean, which weighs against a simple close-as-suspicious but does not offset the counterparty and rate signals.
manual_review_aging_hours is flagged as breach, indicating existing review backlog, which supports escalation to ensure this pattern is not lost among unresolved reviews.
No prior dispositions exist to indicate this pattern was already assessed.

Evidence

{
  "n": 2146,
  "band": "review",
  "skoor": 55,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "2 prior unauthorized return(s)",
      "weight": 40
    },
    {
      "code": "returns.entity_rate_gt_threshold",
      "detail": "entity unauthorized return rate 1/25 originated ACH debits in 60d",
      "weight": 15
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}

Skoor signals

Signal	Weight	Hard	Detail
returns.counterparty_prior_unauthorized	+40		3 prior unauthorized return(s)
returns.entity_rate_gt_threshold	+15		entity unauthorized return rate 1/25 originated ACH debits in 60d

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.