Payoff fraud is a redirected loan payoff: a payoff letter that is right in every figure sends the money to an account the payee lender never held. When it works, three parties discover at once that a payment has gone and a debt has not. The payee lender was never paid, so its loan is not discharged and its lien stays on file. The bank that took the money in is protected by Article 4A of the Uniform Commercial Code unless it actually knew the name and the account did not match. That leaves the loss between the borrower and the bank that sent the payoff, decided by their documents and by whether an agreed security procedure was followed — which is why Botminds' Drawdown & Payoff Request Processing puts the control at the desk that reads the payoff letter, before anything is sent.
This page is about civil loss allocation on a commercial payoff: who ends up out of pocket. It is not legal advice; it is what the Code, a published federal appellate decision and federal agencies say, read for the people who have to write a funding desk's procedure. The desk examples use fictional sample data at a fictional bank. (How Article 4A allocates a fraudulent wire between a bank and its customer in general is covered in a sibling guide; this one follows a payoff.)
One stolen payoff, three exposures
$2,846,310.42
the sample payoff: principal, interest and a fee, good through one day, in a single wire
Not discharged
the payee lender's loan, if the money reached an account that was never the payee's
Actual knowledge
what the receiving bank must have of a name-and-number mismatch before it carries the loss
What is payoff fraud?
Payoff fraud is the loan version of payment redirection. A borrower is refinancing, selling an asset or drawing on a new facility to retire an old one; the old lender's payoff letter is expected; and a letter arrives — from a lookalike domain, or from a genuine mailbox someone has broken into — that is correct in every respect except the account. The money is wired, the payee lender sees nothing, and the first sign of trouble is usually the payee asking why the loan is still unpaid after the good-through date.
On the sample desk the letter was for $2,846,310.42, from a domain one character away from the payee's real one, registered seven days earlier, asking for a bank the payee had never used. It was caught before release. The rest of this page is about what would have followed if it had not been.
If the payoff went to a fraudster, is the loan still owed?
Generally, yes. Article 4A ties discharge to the beneficiary actually being paid: the originator of a funds transfer pays the beneficiary when the beneficiary's bank accepts a payment order for the benefit of that beneficiary, and an obligation the payment was meant to satisfy is discharged to the same extent as a payment in money would discharge it (UCC § 4A-406(a) and (b)). A payment credited to an account the payee lender never held is not a payment for the payee's benefit. The payee has not been paid, so the loan it holds is not discharged.
The practical consequences arrive in order. The payee keeps charging per diem after the good-through date. It does not release its lien or authorise the UCC-3 terminations, because nothing has been repaid. And the borrower now owes twice: the old loan, still outstanding, and the new advance that funded the payoff. Whether the payee's own conduct changes that — if, say, the criminal wrote from the payee's genuine, compromised mailbox — is a question courts decide on the facts and the documents, and it is a reason for the payee to be in the conversation from the first hour.
A payoff that reached the payee, and one that reached a stranger
Paid to the payee's verified account: Yes, to the extent of the payment, when the payee's bank accepts the order
Paid to an account the payee never held: No: the payee has not been paid, so the debt is still owed
Paid to the payee's verified account: Stops
Paid to an account the payee never held: Keeps running against the borrower
Paid to the payee's verified account: Due once the payoff lands; the twenty-day demand clock can start
Paid to an account the payee never held: Not due; the payee still holds its security
Paid to the payee's verified account: Owed, and matched by a retired loan
Paid to an account the payee never held: Owed as well — the borrower now carries both
Paid to the payee's verified account: Nobody
Paid to an account the payee never held: The sending bank, on a recall, within hours
Four parties in one payoff, and where each one's exposure sits
Half the confusion in this subject comes from the word "bank" covering different roles with different exposures. On a payoff there are four. The originator is whoever issues the first payment order — the borrower, or the new lender disbursing loan proceeds at the borrower's direction. The originator's bank executes it. The beneficiary's bank receives the transfer and credits an account. The beneficiary should be the payee lender; in a fraud it is a mule account opened for the purpose and emptied within hours.
The money's journey is one-way, and so is the realistic recovery. By the time anybody notices, the account holder is gone. So the argument is between the borrower and the bank that sent the money, with the receiving bank pulled in only on the name-and-number point — and on that point the receiving bank is in a strong position.
Why the receiving bank is rarely the one that pays
Where a payment order names a beneficiary and gives an account number that belong to different people, the receiving bank that does not know of the conflict may rely on the number and need not check the two against each other (UCC § 4A-207(b)(1)). In 2025 the Fourth Circuit applied that rule to a redirected supplier payment, reversing a judgment that had held the receiving credit union liable for negligence: without actual knowledge of the mismatch it carried no liability under the section (Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union, No. 23-1148, 4th Cir. 2025). The section's text, and the case, are worked through in our guide to UCC 4A-207.
The same section has a second rule that matters on a payoff. Where the originator's own order described the beneficiary inconsistently — the payee's name with the criminal's account number — and the receiving bank paid the number, an originator that is a bank must pay its order, while an originator that is not a bank escapes that obligation only if it proves the number-holder was not entitled to the money and its bank cannot prove it was told in advance that payment might be made on the number alone (UCC § 4A-207(c)). Most account agreements give that notice. On a payoff disbursed by the new lender itself, the lender is the originator and is a bank.
Article 4A is federal law for every Fedwire payoff
Article 4A is a uniform state law, adopted in every state, so its text can vary at the margins. For payments through the Federal Reserve Banks it is also federal: Regulation J, at 12 CFR 210.25, incorporates Article 4A for funds transfers over Fedwire, with the regulation's own provisions prevailing where the two differ.
The practical consequence is that a desk cannot shop for a friendlier state rule on a Fedwire payoff, and a customer agreement cannot quietly rewrite the allocation. It also means the federal case law on these questions applies to the ordinary domestic wire a funding desk sends every day.
When the sending bank carries it instead: an agreed security procedure
Between a customer and its own bank, the allocation turns on the security procedure they agreed. An order the bank received in the customer's name binds the customer, even if the customer never sent it, only where the procedure was a commercially reasonable method of security and the bank accepted the order in good faith and in compliance with it (UCC § 4A-202(b)). Even then the customer can shift the loss back by proving the order was not caused, directly or indirectly, by anyone it trusted with payment duties or anyone who got at its systems or information (UCC § 4A-203(a)(2)) — a heavy burden that most customers cannot carry.
So a payoff sent on an unauthorised order can still be the customer's problem — but only if the bank clears both limbs. A procedure that is not commercially reasonable does not save it. Nor does a reasonable procedure the bank did not actually follow, which is why what the payoff callback record has to show afterwards is not a bureaucratic question.
Four questions decide where a stolen payoff lands, and none of them is about carelessness
1Was the order actually authorised by the customer?
YesAn employee with authority sent it, deceived
This is a fraudulently induced payment. Article 4A's unauthorised-order rules do not reach it; the loss sits with the sender unless a contract says otherwise.
NoSomebody outside sent it in the customer's name
Go to the next question: was there an agreed security procedure?
2Was there an agreed security procedure, and was it commercially reasonable?
YesAgreed, commercially reasonable, and complied with in good faith
The order is effective as the customer's under §4A-202(b) — the customer pays, subject to the next question.
NoNot agreed, or not commercially reasonable
The bank cannot enforce the order against the customer. The loss stays with the bank.
3Can the customer prove the breach came from outside its own circle?
YesNo insider, and no access to its systems or information
Under §4A-203(a)(2) the bank is not entitled to enforce or retain payment. The loss shifts back.
NoIt cannot prove that
The customer bears it. This is the limb most customers cannot clear.
4Did the beneficiary's bank know the name and the number pointed to different people?
YesIt had actual knowledge of the mismatch
The protection of §4A-207(b)(1) falls away and the beneficiary bank is exposed.
NoIt did not know
It may rely on the number. Negligence is not enough, and it has no duty to check the name against it.
Unauthorised order or fraudulently induced payment? On a payoff, usually the second
Everything in the last section assumes the order was unauthorised: sent by somebody with no authority to send it. A redirected payoff is usually not like that. The borrower's own treasurer, or the lender's own funding specialist, pressed send, having been deceived about where the money should go. The Government Accountability Office calls this a "fraudulently induced payment, which occurs when a person with payment authority is manipulated or deceived into making a payment for the benefit of the scammer" (GAO-24-107107, Payment Scams).
That distinction has sharp consequences, because Article 4A's unauthorised-order rules do not reach an authorised payment. The sender told its bank to send money to that account; the bank did. There is nothing for a security procedure to catch, because the order was genuine. The GAO states the consumer position plainly: institutions are "generally not required under federal law to reimburse consumers for losses stemming from a fraudulently induced payment because such a payment is authorized by a person with payment authority on the account". A commercial sender is in a weaker position still, with only its contracts to look to.
Two things people both call a fraudulent wire, with opposite outcomes
Unauthorised payment order: Somebody with no authority, impersonating the customer
Fraudulently induced payment: The customer's own authorised person, deceived about the destination
Unauthorised payment order: Article 4A §§ 4A-202 and 4A-203, through the agreed security procedure
Fraudulently induced payment: Contract and general law; Article 4A's unauthorised-order rules do not engage
Unauthorised payment order: A commercially reasonable procedure, followed in good faith
Fraudulently induced payment: Nothing — the order was genuine
Unauthorised payment order: With whichever side fails its limb — often the customer
Fraudulently induced payment: With the sender
Unauthorised payment order: Authentication of the order, plus dual control
Fraudulently induced payment: Verification of the destination: the account compared with the file, and the callback
Can a stolen payoff be recalled?
Sometimes, if the sending bank moves within hours. A completed wire has no chargeback; what exists is a recall request, in which the sending bank asks the receiving bank to return the funds, usually against an indemnity, and it succeeds when the money is still in the account and the receiving bank co-operates. The FBI's guidance is to contact the financial institution immediately to request the recall, and to file a complaint at ic3.gov with the full transaction details whatever the amount, because that complaint is what starts the federal freeze process (FBI IC3, 2025 Internet Crime Report).
That freeze process, the Financial Fraud Kill Chain, froze 58% of the value it was asked to stop in 2025, down from 66% in 2024 — a good result for a recovery process and a poor basis for a control. What those figures cover and what they leave out is set out in a sibling guide, and how a recall actually runs in another. On a payoff, every hour also adds a day of per diem to a loan that is still outstanding.
What all of this means on a Tuesday afternoon at a funding desk
Put the rules together and the operational conclusion is unavoidable. The payee lender has not been paid until the money reaches its account. The receiving bank will not check the name against the number. The recovery process gets back somewhat more than half of what it reaches, and it reaches a fraction. And the loss allocation turns on documents and a procedure written long before the day it matters. The only party in the chain reliably able to stop a redirected payoff is the one about to send it.
That is where the control has to live, and it has to be mechanical rather than vigilant. On the sample desk the comparison runs on every outgoing instruction — beneficiary name, bank, routing and account against the verified payee file and every payment ever made to that payee — and a difference locks the release. The lock is not advisory and cannot be switched off. Above $1,000,000 a second named person approves, seeing the same checks and the logged call.
On the sample day it was a payoff letter of $2,846,310.42: right obligor, right notes, right arithmetic, and a bank the payee had never used. The money went to the account on file at the payee's own bank, not to the one in the letter, because the comparison happened before the release rather than after the wire. What else that letter had to carry is a separate discipline, and the two together are the reason the loss question never arose.
The instruction that did not match the file, with the signals beside it
Twelve requests, one clock, and a release button that will not move
Questions people ask
Is a loan paid off if the payoff went to a fraudster?
Generally not. Under UCC § 4A-406 an obligation is discharged when the beneficiary's bank accepts a payment order for the benefit of the beneficiary, and a credit to an account the payee lender never held is not for its benefit. The payee has not been paid, so its loan remains outstanding, per diem keeps running, and it has no obligation to release its lien. Whether the payee's own conduct shifts that is decided on the facts.
Who is liable for payoff fraud?
Usually whoever sent the money, or whoever the documents make bear it. The receiving bank is protected unless it actually knew the name and account did not match; the payee lender has not been paid; and between the borrower and the sending bank, the outcome turns on whether the payment was authorised, whether an agreed security procedure was commercially reasonable and followed, and what the loan and account agreements say.
Does the payee lender have to release its lien if the payoff was stolen?
No. A lien release and the UCC-3 terminations follow payment, and the payee has not been paid. The Article 9 deadline to terminate a financing statement runs from an authenticated demand once the secured obligation is satisfied, which it is not. Until the loss is resolved, the old lender's security stays on the public record, which is often what makes the problem visible to everyone else in the deal.
How long do you have to recall a stolen payoff?
There is no fixed deadline, because a recall is a request rather than a right, but the practical window is hours. Funds are usually moved on from a mule account within a day. The FBI's advice is to contact your financial institution immediately to request the recall, and to file at ic3.gov with the full transaction details whatever the amount, which starts the federal freeze process.
Is a payoff sent on a fake letter an unauthorised wire?
Usually not. If the borrower's or the lender's own authorised person released it, deceived about the destination, it is what the GAO calls a fraudulently induced payment: the order was genuine and Article 4A's unauthorised-order rules do not reach it. That is why the control that matters is verification of the destination before release, not authentication of the sender.
What should a funding desk do the moment it suspects a stolen payoff?
Call its own payments area to start a recall, telephone the payee lender on the number already in the payee file to confirm it has not been paid, tell the borrower, and file with the FBI's Internet Crime Complaint Center. Then preserve the record: the letter, the email headers, the comparison that was or was not run, and who released the payment. The first hour decides most of what can be recovered.