Consider a 40-person distribution company. On a Thursday afternoon the controller gets a Teams call from the CEO, who is traveling. The face is right, the voice is right, and so is the impatience. A supplier deal is closing early, the CEO says, and $250,000 needs to go out today to a new account. Wire instructions follow by email. The controller logs into the bank portal, enters the payment, approves it with her token, and the money is gone by 4 p.m. The CEO was on a plane the whole time. The call was synthetic.

The first question every owner asks is “can't the bank just reverse it?” The second, once they hear the answer, is “how is this not the bank's problem?” This article answers both, and then covers what actually moves money back into your account.

Why the bank is usually not liable

Business wire transfers are governed by Article 4A of the Uniform Commercial Code, as enacted in your state. States adopt the uniform text with occasional local variations, so the citations below are to the uniform version. Article 4A's loss rules turn on one question: was the payment order authorized?

Section 4A-202(a) answers it in one sentence. A payment order is the authorized order of the customer “if that person authorized the order or is otherwise bound by it under the law of agency.”

In the hypothetical, the controller is your agent. She has authority to send wires. She logged in with her own credentials and approved the payment herself. Under ordinary agency law, that's your order, even though she was lied to. Article 4A treats the fraud as something that happened between you and the criminal, not as a failure of the bank.

That matters because the rules most owners have heard about, the ones that make banks eat losses, are built for a different situation: an order sent in your name by someone who was not authorized, such as a hacker who took over the portal.

None of those three provisions helps when your own authorized employee pressed the button. The security procedure did exactly what it was designed to do: it confirmed that the order came from your controller. It did. The statute's definition is narrow on purpose. A security procedure under Section 4A-201 is a procedure for verifying that an order “is that of the customer,” or for detecting errors in transmission or content. It is not a procedure for detecting that your employee was deceived.

As of October 2026, there is little or no reported case law applying Article 4A to a deepfake-induced wire specifically. The analysis above comes from the statute's text, and it is the same analysis courts have long applied to ordinary impersonation and business email compromise. Better fakes don't change which box the payment falls into.

Consumer protections don't follow you to the business account

Owners sometimes assume the protections they have on a personal checking account apply here. They don't. Regulation E, the federal rule that limits a consumer's liability for unauthorized electronic transfers, defines an “account” as one “established primarily for personal, family, or household purposes” (12 CFR 1005.2). It also excludes wire transfers through Fedwire or similar systems “used primarily for transfers between financial institutions or between businesses” (12 CFR 1005.3(c)(3)). A business wire falls outside Regulation E on both counts.

How big the problem is

The FBI's Internet Crime Complaint Center tracks this category in its 2025 annual report. In 2025 it received 22,364 complaints “reporting AI-related information,” with adjusted losses above $893 million. The report says voice cloning “can also be used to request wire payment,” and it puts business email compromise losses involving AI at more than $30 million.

Put that $30 million next to total business email compromise losses for the year, about $3.05 billion, and the useful lesson is that most of these losses still come from ordinary impersonation. The deepfake is a stronger version of the same con, so the controls that stop a fake email also stop most fake calls, provided they don't depend on recognizing someone's face or voice.

Banks have been warned too. FinCEN's alert FIN-2024-Alert004 (November 13, 2024) described a rise in suspicious activity reports describing deepfake media used in fraud schemes. That alert is aimed at financial institutions' reporting duties. It doesn't change the Article 4A allocation between a bank and its business customer.

The first 24 hours: where recoveries actually happen

Because the legal claim against your own bank is usually weak, the realistic path to getting money back is speed. The IC3 report's guidance is direct: “If you discover a fraudulent transfer, time is of the essence.” Contact your bank immediately and request a recall of the funds, then file at ic3.gov “regardless of the amount lost,” with full transaction details.

The FBI's Recovery Asset Team runs what it calls the Financial Fraud Kill Chain, which coordinates with banks to freeze funds at the receiving institution. In 2025, the team initiated 3,900 of these incidents involving about $1.16 billion in attempted theft and froze about $679 million, a 58% success rate, per the same report. Those numbers depend on catching the money before it moves again. A same-day report is a different case from a report filed the following week.

Your hour-one list:

The other places money can come from

The beneficiary's bank and the name mismatch. Fraudsters commonly send instructions that name your real supplier but list an account the fraudster controls. Under Section 4A-207(b)(1), a beneficiary's bank that doesn't know the name and number refer to different people “may rely on the number” and “need not determine whether the name and number refer to the same person.” So a name mismatch alone usually won't create bank liability. Whether the receiving bank actually knew of a mismatch is a factual question worth asking a lawyer to explore, but don't build your recovery plan around it.

Insurance. Some losses are covered under a crime policy's social engineering or fraudulent-instruction endorsement, and some under a cyber policy. Many policies cap that coverage with a sublimit far below the policy limit, and many condition it on the insured having confirmed the request through a callback or similar step. Read the endorsement before you need it, and see our discussion of AI exclusions creeping into business policies for why “it involved AI” is now a question carriers ask. The business insurance overview covers which policy types to have.

The one-year deadline. If you believe a debit was not authorized (for example, the portal itself was compromised), Section 4A-505 bars the objection unless you notify the bank “within one year after the notification was received.” Many bank agreements shorten reporting windows further. Read yours.

Controls that change the answer

You can't contract your way into making the bank liable for your employee's decision. You can make that decision much harder to fake.

  1. Out-of-band callback to a known number. Any new payee or change to payment instructions gets confirmed by calling a number already on file, not one in the email or the meeting chat. Make it a written rule with no “CEO exception.” A deepfake works because the target believes the request is coming from the CEO.
  2. Dual approval in the bank portal. Many business banking platforms let you require a second user to release wires above a set amount. Turn it on. A fake call has to fool two people instead of one.
  3. Accept the bank's offered security procedures. Under Section 4A-202(c), if you refuse a commercially reasonable procedure the bank offered and pick a weaker one, and expressly agree in writing to be bound, your chosen procedure is deemed commercially reasonable. Declining features like dual control or callback verification strengthens the bank's position in the hacked-account case, where you might otherwise have a claim.
  4. A pause rule for new payees. A 24-hour hold on first-time beneficiaries kills the “it has to go out today” pressure that every one of these schemes relies on.
  5. A code word, used sparingly. Some owners set a verbal passphrase for urgent payment requests. It helps, but treat it as a backstop to the callback, not a substitute. It can leak.
  6. Train for the scenario that's actually happening. Your employee AI use policy should say plainly that a voice or video call is not verification, no matter who appears to be on it.

A note on who else might be liable

If the impersonation used a vendor's compromised email account, you may have claims against the vendor, and the vendor may have claims against you, depending on who was in the better position to prevent it. Those disputes are governed by your contracts and by state negligence law, and they get expensive fast. Our piece on when your business is liable for AI covers the broader allocation questions. Check whether your vendor contracts say anything about payment-instruction changes. Most don't, and they should.

Frequently asked questions

If the bank's fraud system should have flagged a $250,000 wire to a new account, isn't that negligence?

Article 4A sets detailed rules for who bears the loss on a funds transfer, and claims that try to work around those rules face an uphill fight. For an authorized order, the bank's job under Article 4A is mostly to carry out the order. A bank's internal fraud monitoring is not the security procedure you agreed to, so a missed flag rarely creates liability by itself.

Does it matter that the fake was AI-generated?

Not to the bank question. A payment your employee approved is authorized whether she was fooled by a cloned voice, a spoofed email, or a convincing phone call. It may matter to your insurer if your policy has an AI-related exclusion or a sublimit triggered by “social engineering.”

What if the fraudster got into our bank portal directly instead of tricking an employee?

That is the unauthorized-order case, and your position is meaningfully better. The bank then has to show a commercially reasonable security procedure that it followed in good faith, and Section 4A-203 may still let you recover if the breach didn't come through your people or systems.

This article reflects the uniform text of UCC Article 4A, federal regulations, and FBI and FinCEN publications as of October 2026. Your state's enacted version of Article 4A and your bank agreement control the details. This is general information, not legal advice for your situation.

This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.