400.4A-203. (a) If an accepted payment order is not, undersection 400.4A-202(a), an authorized order of a customeridentified as sender, but is effective as an order of thecustomer pursuant to section 400.4A-202(b), the following rulesapply:
(1) By express written agreement, the receiving bank maylimit the extent to which it is entitled to enforce or retainpayment of the payment order.
(2) The receiving bank is not entitled to enforce or retainpayment of the payment order if the customer proves that theorder was not caused, directly or indirectly, by a person (i)entrusted at any time with duties to act for the customer withrespect to payment orders or the security procedure, or (ii) whoobtained access to transmitting facilities of the customer or whoobtained, from a source controlled by the customer and withoutauthority of the receiving bank, information facilitating breachof the security procedure, regardless of how the information wasobtained or whether the customer was at fault. Informationincludes any access device, computer software, or the like.
(b) This section applies to amendments of payment orders tothe same extent it applies to payment orders.
(L. 1992 S.B. 448)