Transaction Risk Skoor 40 (review band) on a $876.21 ach transfer: returns.counterparty_prior_unauthorized.

What happened. An outgoing ACH credit of $876.21 from program Harbor Marketplace Payouts to counterparty cpty_sim_harb_gzii64r41f was flagged by the skoor_review detector at Skoor 40 (review band) due to a single signal: the counterparty has 5 prior unauthorized returns. The transfer itself settled with no return code. What the evidence shows. The transfer status is SETTLED with return code none, so this specific transfer did not itself return unauthorized. The alert score of 40 is driven entirely by the counterparty's return history (weight 40, hard signal false), not by anything on this transaction. The originating entity, Cedar Services 114, is VERIFIED, not high risk, not PEP, with no review reasons and screening current as of 2026-09-01. The counterparty's country is unknown, which limits verification of the counterparty side. Program KRIs show ach_unauthorized_return_rate at 0.00757 flagged as a breach (n=793), and manual_review_aging_hours also flagged as breach (n=15), while frozen_accounts, overdraft_events, pep_flagged_entities, and high_risk_entity_share are at watch level. Other KRIs (reserve_coverage_ratio, velocity_vs_declared, sanctioned_country_transfers, counterparty_concentration_top1) are within normal range. What was checked. Transfer status and return code, entity verification and risk flags for the originating business, program KRI panel, and prior dispositions (none on file). The counterparty entity record itself is not included in the context beyond its country being unknown, so its own verification status could not be checked. What is recommended. Since the transfer already settled with no return, there is no transfer to hold or release. However, the counterparty's 5 prior unauthorized returns combined with the program-level breach on ach_unauthorized_return_rate suggests a pattern beyond this single alert that a person should examine at the counterparty or program level, including whether this counterparty should be restricted from future outgoing credits under this program.

{
  "n": 1993,
  "band": "review",
  "skoor": 40,
  "signals": [
    {
      "code": "returns.counterparty_prior_unauthorized",
      "detail": "5 prior unauthorized return(s)",
      "weight": 40
    }
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}