Bank liability for wire fraud: what UCC 4A puts on each side

Bank liability for wire fraud depends first on who sent the payment order. Business wires are governed by Article 4A of the Uniform Commercial Code, as each state enacts it and, for Fedwire, as Regulation J incorporates it into federal law. If a fraudster sent the order in the customer's name, the bank bears the loss unless it accepted the order in good faith under a commercially reasonable security procedure the customer agreed to, and complied with it. If the customer's own authorised staff sent the order after being deceived by a forged email, the order is the customer's, and Article 4A generally leaves the loss with the customer. Consumer wires may sit under a different statute altogether. Every step in between is decided by evidence, which is why Botminds' Wire Fraud Prevention records each hold, call, proposal and signature with who, when, why and on which evidence, so the bank can prove what it did. This guide is an explanation of the official text of Article 4A, not legal advice; counsel should read the enactment of the governing state and the bank's own agreements.

The examples come from a fictional sample bank as it runs through the solution, Corvane National Bank, and its client Brightwater Mechanical, whose $286,400.00 wire to a supplier was held on Thursday 22 October after the supplier's bank details changed by email.

Is a bank liable for wire fraud? It turns on who sent the order

A bank is liable for a fraudulent wire when the order was not the customer's and the bank cannot show it was entitled to treat it as the customer's. It is generally not liable when the customer's own authorised people sent the order, even if they were deceived. Article 4A draws that line in its first rule on authority: a payment order "is the authorized order of the person identified as sender if that person authorized the order or is otherwise bound by it under the law of agency."

That rule sorts most wire fraud into two piles. Account takeover, where a criminal logs in as the customer and sends the wire, produces an unauthorised order. Business email compromise, where a criminal emails the customer's staff and they send the wire, usually produces an authorised one. FinCEN drew the same distinction in 2016: in account takeover, criminals "are able to directly execute transactions without submitting transaction instructions", whereas email compromise works by deceiving people into submitting them.

The distinction is not a technicality. It decides which half of Article 4A applies, what the bank has to prove, and how much the bank's own procedures matter. In the sample wire, Brightwater's clerk keyed the order and its CFO approved it with his own token; whatever happened next, that order was Brightwater's.

Unauthorised orders: the security procedure decides

When a fraudster sends the order, the bank can still keep the customer's money, but only by proving three things. Under 4A-202(b), an unauthorised order is "effective as the order of the customer" if the security procedure is a commercially reasonable method of providing security against unauthorised orders, and the bank proves that it accepted the order in good faith and in compliance with the procedure and with any written instruction from the customer restricting acceptance.

"The bank proves" is the operative phrase. The burden is on the bank, and it is a burden of evidence: which procedure was agreed, which step was performed, by whom and when. A procedure that required a callback for new payees, applied by an operator who wrote "called, OK" in a free-text box, is hard to prove. One whose record shows the number, its source, the recording, the answers and both names is not. Section 4A-202(f) adds that these rights "may not be varied by agreement", so a bank cannot contract its way out of the proof.

If the bank cannot prove it, the order is not the customer's, and 4A-204 requires the bank to "refund any payment of the payment order received from the customer" with interest. A skipped step in the agreed procedure is therefore not an operational lapse to be fixed next quarter. It moves the whole loss from the customer to the bank.

What is a commercially reasonable security procedure?

A commercially reasonable security procedure is one that fits the customer, and the question is decided by a judge, not a jury: section 4A-202(c) makes it "a question of law". The section lists what the court weighs.

Commercial reasonableness of a security procedure is a question of law to be determined by considering the wishes of the customer expressed to the bank, the circumstances of the customer known to the bank, including the size, type, and frequency of payment orders normally issued by the customer to the bank, alternative security procedures offered to the customer, and security procedures in general use by customers and receiving banks similarly situated.

UCC §4A-202(c), official text

Three practical points follow. First, reasonableness is measured against this customer: a token and dual approval may be reasonable for a small payroll account and thin for a client that sends $5 million wires. Second, "in general use" moves over time: as callbacks to numbers of known origin and changed-detail holds spread, a procedure without them looks weaker. Third, the section gives banks a safe harbour. A procedure is deemed commercially reasonable if the customer chose it after the bank offered, and the customer refused, one that was reasonable for it, and the customer agreed in writing to be bound by orders accepted under the procedure it chose. That is why many banks document the stronger option every client declined.

Article 4A's own definition of a security procedure names callbacks among its forms. How a callback has to be run to count as one, with the number chosen by the bank and the payee made to state its details, is set out on its own.

Business email compromise: when the customer's own staff send the order

In business email compromise the order is usually authorised, and Article 4A generally leaves the loss with the customer. The clerk and the CFO had authority to send payments; they used it; the bank accepted the order; and under 4A-402 acceptance "obliges the sender to pay the bank the amount of the sender's order". The security procedure question does not arise, because there was no unauthorised order to test it against.

That does not make the bank's controls irrelevant. It makes them a different kind of value. A bank that holds a wire because the payee's bank details changed after 11 payments to the old account, and calls the supplier at a number on file, saves its customer from a loss the law would otherwise leave with the customer. That is what happened to the sample wire: the supplier's controller said nothing had changed, the CFO asked the bank to cancel, and the $286,400.00 never left. FBI complaint data put business email compromise losses at $3,046,598,558 in 2025; little of that is a bank's legal liability, and much of it is its customers' money.

One exception deserves care. A bank that knew an order was fraudulent before it executed it is in a different position from one that did not, and an agreement can impose duties beyond the statute. Counsel should read both before concluding that an authorised order is always the customer's loss.

A stop with two names, and the security procedure the client followed

The customer's escape: proving the breach was not on its side

Even when the bank followed a reasonable procedure, the customer can shift an unauthorised loss back to the bank by proving where the breach did not come from. Under 4A-203(a)(2), the bank may not enforce or keep payment if the customer proves the order was not caused, directly or indirectly, by a person "entrusted at any time with duties to act for the customer with respect to payment orders or the security procedure", or by someone who got access to the customer's transmitting facilities or obtained the information to breach the procedure from a source the customer controlled.

In practice this is hard for a customer to prove, because most account takeovers begin with the customer's own credentials, devices or staff. But it means the bank's procedure is not the end of the inquiry, and a bank that keeps evidence about its own side, such as whether its systems were the source of a credential leak, is better placed when the question is asked.

Refunds, interest and the customer's clocks

When the bank owes a refund on an unauthorised order, it owes interest too, but the customer can lose the interest by waiting. Section 4A-204 says the customer is not entitled to interest if it fails to exercise ordinary care to discover the problem and notify the bank "within a reasonable time not exceeding 90 days" after it was told the order was accepted or the account debited. Separately, 4A-505 bars any objection made more than one year after the customer received notice of the order.

For the wire room the clocks have a simple consequence. A bank that tells clients promptly and clearly about held, stopped and released wires starts the customer's clocks running and gives the client the best chance to object early, while there is still something to recover.

Who pays when a wire goes to a fraudster's account number?

When an order names the right payee but a fraudster's account number, the beneficiary's bank is generally allowed to follow the number. Section 4A-207 says that if it does not know the name and number refer to different persons, it may treat the account number as the beneficiary's identity, and has no duty to check that the name matches (the guide to reversing a fraud wire quotes the section). The loss then follows the order back to whoever sent it.

That rule is why verification belongs on the sending side, before release. Once the money is credited to the account the number names, recovering it depends on the receiving bank's cooperation, a freeze, and speed, the work of Wire Recall Management rather than of the wire room that sent it.

When the customer is a consumer

For consumers, Article 4A may not apply at all. Section 4A-108 says the Article does not apply to a funds transfer any part of which is governed by the Electronic Fund Transfer Act, and in January 2025 a federal judge in New York held that the EFTA can govern the debit from a consumer's account that funds a wire. The judge dismissed the New York Attorney General's Article 4A claim against Citibank for that reason and let the EFTA claim proceed (New York v. Citibank, S.D.N.Y., Opinion and Order of 21 January 2025). The ruling is on appeal, and whether UCC 4A applies to consumer transactions is worked through in its own guide.

The practical effect is large. Under the EFTA a consumer's liability for an unauthorised transfer is capped by how quickly they report it, and the bank bears the burden of proof; under Article 4A the bank can keep the money if its security procedure held. A bank whose consumer customers can send wires online should know which regime its own lawyers think applies.

Can a business sue its bank for wire fraud?

Yes, and when it does the claim usually runs through Article 4A: a demand for a refund under 4A-204 on the ground that the order was unauthorised and not effective against it. The bank's defence is 4A-202(b), and the fight is over two things: whether the procedure was commercially reasonable for this customer, and whether the bank can prove it complied.

Both turn on records the bank creates at the time, not on anything it can reconstruct later. In the solution, every hold, call, proposal, signature, override and recording is kept with who, what, when, why and the evidence, nothing in the trail can be edited, and an auditor can export the payment order, the security procedure followed, the email and document behind the instruction, both recordings and the decision with both names, for examiners or for a client dispute. The export itself is logged.

The evidence a dispute will ask for, exported from a trail nobody can edit

Liability law sets the price of each failure point; the wire room decides how often the bank pays it. The split between agents, the maker and the checker is designed so that every one of those records names a person who saw the evidence. To see the record and the held-wire screens together, start from Wire Fraud Prevention.

Questions people ask

Does a bank have to reimburse a business for wire fraud?

Only if the order was not effective as the business's order: typically an unauthorised order the bank cannot show it accepted under a commercially reasonable, agreed security procedure, followed in good faith (UCC 4A-202, 4A-204). A wire the business's own staff sent after a forged email is usually the business's order, and the statute does not require reimbursement.

Can a bank contract out of Article 4A liability?

Not on the core rules. Section 4A-202(f) says the rights and obligations under 4A-202 and 4A-203 may not be varied by agreement, except that a bank may agree to limit how far it enforces a verified order. What an agreement can do is define the security procedure and record the options the customer declined.

Who is liable when a title company or attorney's email is spoofed?

Under Article 4A, the person who sent the wire on the strength of the spoofed email usually bears the loss as against its own bank, because its order was authorised. Whether it can recover from the party whose email was spoofed is a separate question outside Article 4A, decided by contract and state law.

Is a token and dual approval a commercially reasonable security procedure?

It can be, depending on the customer. Section 4A-202(c) weighs the customer's wishes, the size, type and frequency of its orders, the alternatives offered and what similar banks and customers use. The same procedure may be reasonable for one client and weak for another that sends larger, rarer wires.

Does Regulation J change any of this for Fedwire?

Regulation J subpart B governs funds transfers through Fedwire and incorporates Article 4A, giving it the force of federal law for those transfers. The allocation of loss is the Article 4A allocation; what changes is that federal rather than state law supplies it for the Fedwire part of the transfer.