UCC Article 4A can apply to consumer transactions: it governs wire transfers by whoever sends them, and nothing in it is limited to businesses. But section 4A-108 says the Article "does not apply to a funds transfer any part of which is governed by the Electronic Fund Transfer Act of 1978". For decades that seemed to settle consumer wires in Article 4A's favour, because the EFTA and Regulation E exclude transfers through Fedwire and similar wire systems. In January 2025 a federal judge in New York held that the electronic debit from a consumer's account that pays for an online wire is itself an electronic fund transfer, so the EFTA can govern consumer wire fraud and Article 4A drops out. Citibank has appealed. For a bank whose consumers can send wires online, the answer decides who bears a fraud loss, how fast the bank must investigate, and who has to prove what. Botminds' Wire Fraud Prevention holds and records consumer wires the same way under either law, so the evidence exists whichever court is right. This guide explains the official texts and the ruling; it is not legal advice.
Where the guide shows the solution, the data are a fictional sample bank's: Corvane National Bank, as it runs Wire Fraud Prevention.
Which law decides a consumer's wire: a decision tree for the wire room and counsel
1. Is the account held primarily for personal, family or household purposes?
Yes
Go to 2.
No
Article 4A (through Regulation J for the Fedwire part). Regulation E does not cover business accounts.
2. Was any part of the transfer an electronic fund transfer, such as a debit the consumer (or a fraudster) started in online or mobile banking, or an ACH credit at the far end?
Yes
Go to 3.
No
Article 4A. A wire requested in person on a signed form, with no electronic leg, is outside the EFTA; the Fedwire leg is excluded by 15 U.S.C. 1693a(7)(B) and Reg E 1005.3(c)(3).
3. Is that electronic part governed by the EFTA, rather than excluded as part of the wire?
Yes
The EFTA and Regulation E govern that part, and under 4A-108(a) Article 4A does not apply to the funds transfer. This is the S.D.N.Y. ruling in New York v. Citibank (January 2025), now on interlocutory appeal.
No
Article 4A, if the appeals court holds that the wire-transfer exclusion reaches the funding debit too.
4. Separately: is it a consumer's transfer to someone abroad (a remittance transfer)?
Yes
Regulation E subpart B adds its own disclosure and error rules. Under 4A-108(b), Article 4A still applies to a remittance transfer unless it is also an electronic fund transfer.
No
Steps 1 to 3 decide.
Does UCC 4A apply to consumer transactions? The short answer
Yes, unless the EFTA governs any part of the transfer. Article 4A has no consumer exception of its own. A consumer who walks into a branch and signs a wire request makes a payment order like any business, and Article 4A, together with Regulation J for the Fedwire leg, decides what happens if it goes wrong.
The exception is 4A-108, and it is total. Where any part of a funds transfer is governed by the EFTA, Article 4A does not apply to the funds transfer at all; where both apply, the EFTA wins any inconsistency. In the Citibank case, counsel for the New York Attorney General put the effect plainly at argument, as the court quoted: "if any part of a funds transfer is subject to the EFTA and Reg E, then Article 4A goes away entirely."
So the real question is narrower than the search suggests. It is not whether consumers can use Article 4A, but whether a particular consumer wire has a leg that is an electronic fund transfer.
What is UCC 4A-108?
Section 4A-108 is Article 4A's boundary with federal consumer law, and it has three parts in the official text. Subsection (a) excludes from Article 4A any funds transfer any part of which the EFTA governs. Subsection (b), added for international consumer transfers, says Article 4A applies to a remittance transfer as the EFTA defines it, "unless the remittance transfer is an electronic fund transfer". Subsection (c) says that where both laws apply, "the provision of the Electronic Fund Transfer Act governs to the extent of the inconsistency."
States enact Article 4A themselves, and some enactments may not carry the later amendments that added (b) and (c). Counsel should read the governing state's version. New York's, which the Citibank court applied, contains the "any part" language of (a).
Does Regulation E apply to wire transfers?
Not to the wire itself. Regulation E excludes "Any transfer of funds through Fedwire or through a similar wire transfer system that is used primarily for transfers between financial institutions or between businesses", mirroring the EFTA's own exclusion at 15 U.S.C. 1693a(7)(B). The official interpretation names the similar systems: CHIPS, SWIFT, Telex and transfers on the books of correspondent banks.
The same interpretation shows the edges of that exclusion. If a bank receives a wire through Fedwire and then credits a consumer by ACH, the ACH leg "is covered by the regulation even though the Fedwire or network transfer is exempt". And it records that the Federal Reserve used its pre-emptive power so that Regulation J subpart B, including Article 4A, applies to all transfers through Fedwire "even if a portion of the fund transfer is governed by the EFTA", while "The portion of the fund transfer that is governed by the EFTA is not governed by subpart B of the Board's Regulation J." Regulation E has always contemplated wires with an EFTA leg; the open question is which legs count.
Is a wire an electronic fund transfer? The legs of one consumer wire
A consumer wire is several transfers, and they need not all fall under the same law. The Citibank complaint described an online wire as a chain: the consumer's payment order to the bank, the debit of the consumer's account to pay for it, the bank's own order over the wire network, and the beneficiary bank's credit to the payee. The court accepted, for the motion to dismiss, that these are distinct transfers.
The legs of one online consumer wire, and the law each one points to
| Leg | What moves | Which law, on the official texts and the January 2025 ruling |
|---|---|---|
| Consumer's order in online banking, and the debit that pays for it | Money from the consumer's account to the bank, ordered electronically | The EFTA, said the S.D.N.Y.: the wire exclusion does not reach this debit (on appeal) |
| The bank's order over Fedwire or CHIPS | Settlement between banks | Excluded from the EFTA (1693a(7)(B), Reg E 1005.3(c)(3)); Regulation J and Article 4A for Fedwire |
| The beneficiary bank's credit to the payee | Money into the payee's account | Article 4A for a wire credit; an ACH credit to a consumer account is covered by Regulation E |
| The same wire requested in a branch on a signed form | As above, but no electronic order by the consumer | Article 4A: no EFTA leg, unless the payout leg is one |
Citibank did not dispute that the chain has several segments. In the court's later order, it quoted Citibank's reply: "it disputes whether the NYAG can isolate some of those segments and bring EFTA claims about them." That is the whole fight in one sentence.
What did the court say in New York v. Citibank?
The court held that the EFTA's wire-transfer exclusion does not cover the debit that funds a consumer's online wire. The New York Attorney General sued Citibank in January 2024 over consumers whose online banking had been taken over and whose money had been wired out. Citibank moved to dismiss the EFTA claim on the ground that 15 U.S.C. 1693a(7)(B) takes wires out of the statute. On 21 January 2025 Judge J. Paul Oetken of the Southern District of New York refused.
The Court holds that 15 U.S.C. § 1693a(7)(B) does not preclude EFTA liability for a fraudulent Payment Order resulting in a debit from a consumer account in connection with a wire transfer.
People of the State of New York v. Citibank, N.A., No. 24-cv-659 (S.D.N.Y.), Opinion and Order, 21 January 2025
The court read the exclusion's text as covering the transfer between banks on the wire network, not "electronic transfers of funds between consumers and their financial institutions, even when made ancillary to an interbank wire". It then dismissed the Attorney General's separate claim under New York's Article 4A, because once the EFTA governs part of the transfer, 4A-108 takes Article 4A out. It acknowledged that other courts had reached the contrary view, though it found that none had addressed the argument made here.
New York v. Citibank so far
| Date | Step | What it means |
|---|---|---|
| 30 Jan 2024 | New York Attorney General sues Citibank (S.D.N.Y., 24-cv-659) | EFTA, Article 4A and state-law claims over consumer wire fraud |
| 21 Jan 2025 | Opinion and Order on the motion to dismiss | EFTA claim survives; the Article 4A claim is dismissed under 4A-108 |
| 22 Apr 2025 | Order certified for interlocutory appeal; case stayed | The court finds "substantial ground for difference of opinion" on the question |
| 3 Sep 2025 | Second Circuit grants leave to appeal and expedites | The appeals court will decide the reach of 1693a(7)(B) |
The district judge explained why the question deserved an early appeal: discovery under the Article 4A claim "would center largely on Citibank's security protocols", while an EFTA claim would center on "whether individual transfers constituted unauthorized electronic fund transfers and whether Citibank provisionally credited and ultimately reimbursed consumers". That sentence is also the best summary of what changes for a bank, and the Attorney General's own account of the ruling is in its press release.
Which rules change when the EFTA governs
If the EFTA governs a consumer wire fraud, the bank's defence moves from its security procedure to the consumer's reporting and the bank's investigation. Under Article 4A the bank keeps the money if it accepted an unauthorised order under a commercially reasonable security procedure the customer agreed to, in good faith and in compliance with it. Under the EFTA the consumer's liability for an unauthorised transfer is capped by when they report it, and the bank must investigate on a clock and bears the burden of proof.
One fraudulent consumer wire, decided under Article 4A or under the EFTA
Article 4A: The customer, if the bank proves good faith and compliance with a commercially reasonable, agreed security procedure (4A-202(b))
EFTA and Regulation E: Mostly the bank: the consumer's liability is capped at $50 if they report within two business days of learning of a lost or stolen access device, $500 after that, and unlimited only for later transfers after 60 days from the statement (1005.6)
Article 4A: Not sent or authorised by the customer, and not effective under the security procedure
EFTA and Regulation E: Initiated by someone without actual authority, from which the consumer received no benefit (1005.2(m)); credentials tricked out of a consumer still count
Article 4A: Refund with interest if not entitled to keep the payment (4A-204)
EFTA and Regulation E: Investigate within 10 business days, or up to 45 days with provisional credit within 10 (1005.11(c))
Article 4A: The bank proves its compliance with the procedure
EFTA and Regulation E: The bank bears the burden of proof on liability (15 U.S.C. 1693g(b))
Article 4A: An authorised order; the consumer generally bears it
EFTA and Regulation E: An authorised transfer; not an unauthorised EFT, so the liability caps do not apply
The CFPB's compliance FAQs make the credential point directly: when a third party tricks a consumer into sharing account access information and uses it to start a transfer, the CFPB answers that "the EFT is an unauthorized EFT", because the fraudster had no actual authority and the consumer received no benefit. That is the account-takeover pattern in the Citibank complaint. A consumer who is talked into sending the wire themselves is a different case: the transfer is authorised, under either law.
Who is liable for a consumer wire fraud?
It depends on who started the transfer and, for now, on which court you are in. If a fraudster took over online banking and started the wire, the Citibank reasoning puts the funding debit under the EFTA, where the consumer's liability is capped and the bank must prove otherwise; a court that reads the wire exclusion broadly would apply Article 4A, where the bank's security procedure decides. If the consumer sent the wire after being deceived, the transfer is the consumer's under both, and the loss generally stays with them. How Article 4A divides the loss for business wires is covered separately.
The second case is where prevention matters most, because the law offers the consumer little. A consumer wiring savings to an "investment platform" or a "bank security officer" is sending an authorised payment. In the solution, a consumer wire with scam signals gets a customer conversation agent that prepares plain, respectful questions for investment, romance, impersonation and elder exploitation scams, and the trusted-contact step; it never refuses a customer's wire on its own, and the customer decides. Whether a bank can hold that wire while the conversation happens is a question of its own.
International consumer transfers add one more layer. A consumer's transfer to a recipient abroad is often a remittance transfer under Regulation E's subpart B, with its own disclosures and error-resolution rules, and 4A-108(b) keeps Article 4A in play for such a transfer unless it is also an electronic fund transfer. Remittance Transfer Rule Compliance covers that rule.
What to do while the appeal is pending
A bank cannot know yet which regime its consumer online wires fall under, so it should be ready to defend under both. That means three things in the wire room.
First, treat a consumer's report of an unauthorised online wire as a possible notice of error, so the Regulation E clocks are met if they turn out to apply. Second, keep the evidence that Article 4A would ask for, namely the security procedure the consumer agreed to and proof that each step was followed, because that is the defence if they do not. Third, record who started each transfer and how, since the line between a taken-over account and a deceived customer decides the outcome under both laws.
One held wire's evidence: who sent it, what changed, and what was done
The solution records each of those facts for every held wire: the channel and approvals behind the order, what changed against the customer's history, the callback and its number's origin, and the decision with two names, in a trail nobody can edit. An auditor can export it for examiners or for a dispute, under whichever law the dispute turns out to need.
The record, exported for a dispute under either law
Whichever way the Second Circuit rules, the wire room's job before release is the same: find what changed, test it with a callback to a number of known origin, and have two people decide. To see that work on held wires, start from Wire Fraud Prevention.
Questions people ask
Does Regulation E cover international wire transfers?
Regulation E's remittance transfer rule, subpart B, covers many transfers a consumer sends abroad, and its official interpretation lists "Consumer wire transfers" among its examples, with disclosure and error-resolution duties of its own. The general exclusion for Fedwire and similar wire systems in 1005.3(c)(3) does not remove a transfer from subpart B where that subpart applies.
Does UCC 4A apply to ACH?
It can. Article 4A defines a payment order as an "instruction of a sender to a receiving bank, transmitted orally, electronically, or in writing, to pay" a beneficiary, without naming a payment system, so a credit sent by ACH can be one; debits are not. But 4A-108 still applies, so wherever the EFTA governs part of the transfer, as it usually does for ACH to or from a consumer's account, Article 4A gives way to Regulation E.
Did the court in New York v. Citibank find that Citibank broke the law?
No. It decided a motion to dismiss, assuming the complaint's facts were true, and held that the Attorney General's EFTA claim could proceed. The Attorney General's characterisations of Citibank's conduct are allegations; the case was stayed in April 2025 for the interlocutory appeal.
Can a bank's agreement make Article 4A apply to a consumer's wire?
Not where the EFTA governs. The EFTA does not allow an agreement to waive a consumer's rights, and the Citibank court let the Attorney General pursue a claim that a user agreement's burden-of-proof terms did exactly that. An agreement can define the security procedure for the parts Article 4A does govern.
Who is liable if a consumer is tricked into sending a wire?
Usually the consumer, as the law stands. A wire the consumer orders themselves, even after being deceived, is an authorised transfer under both Article 4A and the EFTA. Prevention, through a held wire, a callback and a careful conversation, is the consumer's main protection.