Blog header image -- keyboard with button labeled Bank Wire Transfer

Who Pays When a Wire or ACH Transfer Goes to a Scammer? (Usually You.)

By[email protected]

Imagine this: the wire went out Tuesday. By Thursday you know it was fraud. You call your bank, and the person on the phone is kind and sympathetic and takes careful notes, and somewhere in the conversation you realize they are not telling you they’ll fix it. You wonder, who is liable for business wire fraud?

So you ask the direct question. Will I get the money back?

And there’s a pause.

Most business owners assume there’s a floor under them here — that the bank will absorb it, or the insurance will, or that somewhere in the fine print is a consumer protection that applies. I want to walk you through what’s actually true, because it’s better to know this on an ordinary day than during the worst week of your business life.

Here’s the short version. Who is liable for business wire fraud? When your business authorizes a wire — even because a convincing scammer tricked you — the loss is almost always yours. Business accounts don’t get the federal fraud protections that cover your personal debit card. Your bank generally isn’t liable unless it had actual knowledge something was wrong, and a court has held that a bank’s own automated fraud alert doesn’t count. Your cyber policy may cover social engineering only through a separate endorsement with a sublimit far below your policy limit. The most useful things you can do all happen before a loss: ask your bank what security procedures you’ve accepted or declined, and ask your broker three specific questions.

Here’s what the rest of this post covers:

  • Regulation E doesn’t apply to business accounts — not even a sole proprietor’s business checking, and your dispute window may be one business day rather than sixty
  • The word that decides everything is “authorized,” and a wire your own employee sent counts as authorized even when a scammer caused it
  • A bank’s fraud software flagged a mismatch and the bank still won, because no human employee personally registered the alert
  • You may have already accepted the risk in writing by declining a security procedure you don’t remember being offered
  • A Texas builder lost $874,863.70 and recovered $250,000, because two wires a minute apart hit a single sublimit
  • An unrelated error on your insurance application can void the entire policy, not just the claim
  • No US court has decided whether a deepfake-induced wire is “authorized” — that’s still open

Let’s dig in.

And a caveat: I’m a security person, not a lawyer. This is the landscape, not legal advice about your situation.

Your Business Account Has None of the Protections Your Debit Card Has

Start here, because this is the assumption that hurts people most.

Regulation E, which implements the Electronic Fund Transfer Act, is what gives you a $50 liability cap and provisional credit within ten days when your personal card gets used fraudulently. It’s defined to cover accounts held by a “natural person… for personal, family, or household purposes” (FDIC Consumer Compliance Examination Manual).

That definition excludes business accounts. All of them — including a sole proprietorship’s business checking, even though the same human being owns it.

The practical consequences are sharper than most owners expect. Instead of the 60-day dispute window you have as a consumer, a business account agreement may give you only until the next business day to report a fraudulent debit (First National Bank of Omaha). And Regulation E generally doesn’t cover wire transfers even for consumers.

So the protections you’ve spent your adult life relying on simply aren’t in the room.

The Word That Decides Everything Is “Authorized”

Business wires are governed by Article 4A of the Uniform Commercial Code, adopted in some form in every state. Article 4A splits the world in two: transfers that were authorized and transfers that were unauthorized.

Unauthorized transfers — someone broke into your account and moved money without anyone at your company doing anything — are largely the bank’s problem.

Authorized transfers are yours.

And here’s the trap. If your bookkeeper, who normally sends wires, logs in and sends a wire, that wire is authorized. It doesn’t matter that a scammer’s email caused it. It doesn’t matter that the invoice was forged. Courts have held that once the person who normally sends payment orders does the sending, the analysis doesn’t then turn on whether the bank verified anything (Consumer Financial Services Law Monitor).

Being deceived into authorizing something still counts as authorizing it. That single distinction decides most of these cases before anything else gets argued.

A Bank’s Own Fraud Alert May Not Count as the Bank Knowing

There’s a narrow path where the receiving bank can be liable. When an electronic payment beneficiary name and account number don’t match, Article 4A makes the receiving bank responsible only if it had actual knowledge of the mismatch.

Which raises an obvious question: what if the bank’s computer noticed?

In Studco Building Systems v. 1st Advantage Federal Credit Union, that’s exactly what happened. The receiving credit union’s automated system generated an internal mismatch warning before the money moved. A district court awarded Studco $558,868.71. The Fourth Circuit reversed, holding that an automated internal flag was not “actual knowledge,” because no individual human employee personally registered it. The Supreme Court declined to hear the case in October 2025 (Fourth Circuit opinion).

The computer noticed. The court held that the bank didn’t.

As banks automate fraud detection, the legal standard seems it will reward the institution where no human reads the alert.

You May Have Already Accepted the Risk Without Realizing It

This is the part almost nobody knows about, and it’s the one you can still do something about.

Under Article 4A, if your bank offers you a security procedure for electronic payment transfers and you choose a lighter one, the law can treat that as you accepting the risk of loss (Cornell Law School, UCC 4A-202). If the procedure the bank offered was commercially reasonable and you declined it, the loss can be locked to your side of the ledger — and it stays there until somebody renegotiates (Community Banking Connections).

The reason this matters so much is that “declining” rarely feels like declining. It can look like choosing a lower-tier account package, skipping an add-on service, saying no thanks to a token, or never enrolling in Positive Pay when the banker mentioned it three years ago.

Some bank agreements explicitly shift liability for check and ACH fraud to the customer because Positive Pay was offered and not taken up. So enrolling in these tools isn’t only about reducing your odds of being hit. It can change who absorbs the loss when you are.

You can find out where you stand with one question, which I’ll give you below.

Your Cyber Policy Probably Caps This Far Below Your Limit

Now insurance, where the pattern repeats: the coverage you assume you have is usually narrower than you think.

Social engineering fraud — someone tricks your employee into sending money — is commonly excluded from base cyber policies and requires a specific endorsement, often labeled “fraudulent instruction” or “social engineering fraud” (Insureon). That endorsement typically carries its own sublimit, well below your overall policy limit.

Here’s what that looks like in practice. In Perry & Perry Builders v. Cowbell Cyber, a Texas builder sent two wires totaling $874,863.70 — one minute apart — to a scammer. The policy’s social engineering endorsement carried a $250,000 sublimit. The court held the insurer owed $250,000 for the policy period, not $250,000 per transfer (Law360).

Two wires, sixty seconds apart, one sublimit. About $625,000 uninsured.

There’s a second insurance risk that’s easy to miss. An insurer can seek to rescind the entire policy — not deny one claim, void the whole thing — over a misrepresentation on your application, and in most states they don’t have to show the misstatement had anything to do with your actual loss (Risk Management Magazine). If someone at your company checked a box saying you enforce multi-factor authentication everywhere and you don’t, that box is a liability. A no-rescission or severability endorsement is one of the few ways to close that gap in advance (Breezy Risk).

Many policies also impose conditions you must satisfy for a claim to be honored — documented callback verification, dual authorization above a threshold. Fail the condition, lose the claim.

Two Things the Courts Haven’t Settled

Whether a deepfake changes the analysis. If an employee wires money after a video call with an AI-generated version of you, was that wire authorized? As of mid-2026, legal commentators can’t point to a single reported US decision squarely deciding it (Wright Law). Still open.

Whether Regulation E reaches online wires at all. The New York Attorney General sued Citibank arguing that it does, at least for consumers. The Second Circuit heard argument in April 2026 and, as of this writing, hasn’t ruled. The Consumer Financial Protection Bureau changed its own position mid-case (Cozen O’Connor). Worth watching — but note it concerns consumer wires, so even a plaintiff-friendly ruling wouldn’t directly change the analysis for your business account.

Six Questions to Ask (Before You Need the Answers)

Three for your banker, three for your broker. None of them take long, and all of them are cheaper now than later.

Ask your bank:

  1. What security procedures for wire transfers have you offered us, and did we accept or decline any of them? Get the answer in writing. Given how much turns on the commercially reasonable procedure test, this is probably the single most consequential pre-loss question available to you.
  2. What’s actually enabled on our account today — dual authorization above a dollar threshold, callback verification to a number you hold on file, out-of-band or token authentication — and what’s available that we haven’t turned on?
  3. What does our account agreement say about your liability for wire fraud, and what is our real dispute deadline? If the answer is one business day, you want to know that today.

Ask your broker:

  1. Is social engineering or fraudulent instruction fraud actually covered on this policy, or excluded by default? Confirm it’s an active endorsement rather than an assumption.
  2. What is the sublimit, separate from the overall policy limit, and what would it cost to raise it? Raising it is often inexpensive next to a Perry & Perry-sized gap.
  3. Does this policy include a no-rescission or severability endorsement, and what exact verification steps does it require before a claim is honored? Ask for that in plain language, not cross-referenced definitions.

While you’re at it, document a procedure to make sure that you keep the records that make a claim defensible: a log of callback verification calls including the number you called and where you got it, who approved which wires and when, the original fraudulent message, the bank’s written answers about security procedures, and a paper trail showing your insurance application answers matched reality at the time you applied.

Questions People Ask About Wire Fraud Liability

A reminder — I’m not a lawyer. These are general answers. Definitely confer with your lawyer for specifics to you.

Who is liable if my business wires money to a scammer? In most cases your business absorbs the loss. Under UCC Article 4A, a wire sent by someone at your company who normally sends wires is treated as “authorized” even if a scammer induced it, and authorized transfers are the customer’s responsibility. The receiving bank is generally liable for a name and account number mismatch only if it had actual knowledge of the discrepancy.

Does Regulation E protect business bank accounts? No. Regulation E covers accounts held by a natural person for personal, family, or household purposes, which excludes business accounts — including a sole proprietor’s business checking. Business accounts also generally don’t get the 60-day dispute window; some agreements require reporting by the next business day.

Can I sue my bank for a business email compromise loss? You can, but it’s structurally difficult. Article 4A was written to give banks predictable liability limits, and the authorized/unauthorized distinction usually resolves the case before questions about the bank’s conduct get reached. In Studco Building Systems v. 1st Advantage Federal Credit Union, a $558,868.71 district court award was reversed on appeal because the bank’s automated mismatch alert didn’t constitute “actual knowledge.”

Does cyber insurance cover social engineering fraud? Usually only through a separate endorsement, and often with a sublimit far below the policy limit. In Perry & Perry Builders v. Cowbell Cyber, a $250,000 sublimit capped recovery on $874,863.70 in fraudulent wires sent one minute apart. Ask your broker specifically whether fraudulent instruction coverage is active and what the sublimit is.

Can an insurer void my policy over an application mistake? Yes, in most states, and they generally don’t have to prove the misrepresentation caused your loss. Rescission voids the whole policy rather than one claim. A no-rescission or severability endorsement is the standard protection against this, and it’s worth asking for by name.

Is a deepfake-induced wire transfer “authorized” under the law? Unresolved. As of mid-2026 there’s no reported US decision squarely deciding whether a transfer induced by an AI-generated voice or video is authorized or unauthorized under Article 4A. Don’t count on a favorable answer.

Does enrolling in Positive Pay change my legal liability? It can. Courts examining whether a bank’s security procedures were commercially reasonable look at what was offered and whether the customer accepted or declined it. Some bank agreements shift check and ACH fraud liability to the customer specifically because Positive Pay was offered and not taken. Ask your bank directly how your agreement treats a declined security procedure.

Want help?

If you’d like a second set of eyes on your agreements or policies — before anything goes wrong — that’s a fair use of a free consult. Bring them and we’ll do a quick read together; I’ll give you the security point of view.

[Book a free consult]

If you missed the prevention side — how to stop the fraudulent payment request from succeeding in the first place — read the post on vendor bank detail changes.

Sources

Similar Posts