1. Which Laws Apply to Unauthorized Business Bank Transfers?
State-enacted UCC Article 4A generally governs qualifying business funds transfers. The payment system, governing law, and account agreements determine how responsibility is allocated.
When UCC Article 4A Governs a Payment Order
Article 4A governs qualifying payment orders, including unauthorized business wires. Federal Regulation J, 12 C.F.R. Part 210, Subpart B, incorporates Article 4A provisions for covered Fedwire transfers, subject to applicable federal requirements. ACH transactions require separate analysis under network rules, agreements, and law. Regulation E generally does not protect ordinary business accounts.
An order submitted by an intruder differs from one an authorized employee sends after being deceived. The latter may be legally authorized despite the underlying fraud.
How Account Agreements Affect Payment Authorization
Treasury management agreements define authorized users, transfer limits, authentication methods, and reporting duties. These provisions help establish obligations in a banking dispute, but contractual disclaimers cannot override the mandatory liability rules of UCC § 4-A-202.
2. When Is a Bank Responsible for an Unauthorized Transfer?
UCC § 4-A-202 distinguishes authorized payment orders from unauthorized instructions that may nevertheless become effective against the customer. A bank relying on an agreed security procedure must satisfy statutory conditions.
When Is a Business Payment Order Authorized?
Under § 4-A-202(1), an order is authorized if the customer approved it or agency law otherwise binds the customer. Possession of valid credentials does not alone establish authorization. The business must determine whether an authorized employee issued the instruction or an outsider used compromised access.
When Does a Security Procedure Bind the Customer?
Under § 4-A-202(2), an unauthorized order may become effective if the agreed security procedure was commercially reasonable and the bank proves good-faith acceptance and compliance with its security obligations and applicable customer restrictions evidenced by a record. The bank need not follow an instruction that violates an agreement evidenced by a record or arrives too late for reasonable action.
Commercial reasonableness considers customer circumstances, transaction patterns, available alternatives, and comparable banking practices. Under New York UCC § 4-A-201, requiring instructions to originate from a known email address, IP address, or telephone number is not, by itself, a security procedure. A missed required callback may undermine the bank's defense.
3. Who Bears the Loss after a Fraudulent Wire Transfer?
An unauthorized order may satisfy § 4-A-202(2) yet remain unenforceable under § 4-A-203. The source of the fraudulent instruction determines whether this additional protection applies.
When a Verified Payment Order Cannot Be Enforced
Under § 4-A-203, a customer may defeat enforcement by proving that the unauthorized order was not caused, directly or indirectly, by someone entrusted at any time with payment or security duties, or by someone who accessed customer transmission facilities or obtained information facilitating a security breach from a customer-controlled source without the receiving bank's authority.
Employee access records, credential histories, and system logs help establish the source of the fraud. Neither successful authentication nor an external attack alone resolves liability.
How Reporting Deadlines Affect Refund Rights
Under § 4-A-204, a bank must generally refund payment to the extent it cannot enforce the order against the customer. Failure to exercise ordinary care and report an unauthorized order within a reasonable period, not exceeding 90 days after the specified bank notification, may eliminate interest on the refund but does not itself extinguish the principal refund obligation.
Section 4-A-505 separately precludes certain objections if the customer fails to notify the bank within one year after receiving notice reasonably identifying the order. Applicable agreements and governing law also require review.
4. What Evidence Matters before Challenging a Bank Transfer?
A business should promptly report suspected fraud, request recovery assistance, and preserve transaction records. A wire recall does not guarantee recovery or establish bank liability.
Preserve Transaction and Authentication Records
The following records help establish authorization, security compliance, and the source of the disputed instruction:
- Account agreements: Security procedures, authorized users, and transfer restrictions.
- Payment records: Instructions, timestamps, amounts, and beneficiary details.
- Security logs: Login activity, device access, verification messages, and callback records.
- Internal communications: Employee approvals, suspicious emails, and credential compromise.
- Bank correspondence: Fraud reports, recall requests, and investigation responses.
Banks may control evidence unavailable through account statements. Early preservation requests can support subsequent banking litigation.
Which Claims Can Support Recovery?
A claim must identify the bank's statutory or contractual obligation and the facts establishing liability. Article 4A may displace conflicting common-law claims, while independent claims require separate legal grounds.
A wire transfer fraud dispute may involve other financial institutions or the fraudster. Each party's conduct and the applicable law determine potential claims.
5. Legal Review of Unauthorized Business Wire Transfers
A disputed business wire transfer requires prompt examination of payment instructions, account agreements, authentication records, and bank notifications. Daeryun Law Firm can assess these materials, evaluate liability under UCC Article 4A, and identify available legal remedies based on the applicable law.
04 Nov, 2026
