Section 4-A-202. Authorized and Verified Payment Orders.

(1) A payment order received by the receiving bank is the authorized
order of the person identified as sender if that person authorized the
order or is otherwise bound by it under the law of agency.

(2) If a bank and its customer have agreed that the authenticity of
payment orders issued to the bank in the name of the customer as sender
will be verified pursuant to a security procedure, a payment order
received by the receiving bank is effective as the order of the
customer, whether or not authorized, if (a) the security procedure is a
commercially reasonable method of providing security against
unauthorized payment orders, and (b) the bank proves that it accepted
the payment order in good faith and in compliance with the security
procedure and any written agreement or instruction of the customer
restricting acceptance of payment orders issued in the name of the
customer. The bank is not required to follow an instruction that
violates a written agreement with the customer or notice of which is not
received at a time and in a manner affording the bank a reasonable
opportunity to act on it before the payment order is accepted.

(3) Commercial reasonableness of a security procedure is a question of
law to be determined by considering the wishes of the customer expressed
to the bank, the circumstances of the customer known to the bank,
including the size, type, and frequency of payment orders normally
issued by the customer to the bank, alternative security procedures
offered to the customer, and security procedures in general use by
customers and receiving banks similarly situated. A security procedure
is deemed to be commercially reasonable if (a) the security procedure
was chosen by the customer after the bank offered, and the customer
refused, a security procedure that was commercially reasonable for that
customer, and (b) the customer expressly agreed in writing to be bound
by any payment order, whether or not authorized, issued in its name and
accepted by the bank in compliance with the security procedure chosen by
the customer.

(4) The term "sender" in this Article includes the customer in whose
name a payment order is issued if the order is the authorized order of
the customer under subsection (1), or it is effective as the order of
the customer under subsection (2).

(5) This section applies to amendments and cancellations of payment
orders to the same extent it applies to payment orders.

(6) Except as provided in this section and in paragraph (a) of
subsection (l) of Section 4-A-203, rights and obligations arising under
this section or Section 4-A-203 may not be varied by agreement.