Section 4-A-202. Authorized and Verified Payment Orders

(1)  A  payment order received by the receiving bank is the authorized
  order of the person identified as sender if that person  authorized  the
  order or is otherwise bound by it under the law of agency.
    (2)  If  a  bank and its customer have agreed that the authenticity of
  payment orders issued to the bank in the name of the customer as  sender
  will  be  verified  pursuant  to  a  security procedure, a payment order
  received by the  receiving  bank  is  effective  as  the  order  of  the
  customer,  whether or not authorized, if (a) the security procedure is a
  commercially   reasonable   method   of   providing   security   against
  unauthorized  payment  orders,  and (b) the bank proves that it accepted
  the payment order in good faith and  in  compliance  with  the  security
  procedure  and  any  written  agreement  or  instruction of the customer
  restricting acceptance of payment orders  issued  in  the  name  of  the
  customer.  The  bank  is  not  required  to  follow  an instruction that
  violates a written agreement with the customer or notice of which is not
  received at a time and in a  manner  affording  the  bank  a  reasonable
  opportunity to act on it before the payment order is accepted.
    (3) Commercial reasonableness of a security procedure is a question of
  law to be determined by considering the wishes of the customer expressed
  to  the  bank,  the  circumstances  of  the  customer known to the bank,
  including the size, type,  and  frequency  of  payment  orders  normally
  issued  by  the  customer  to  the bank, alternative security procedures
  offered to the customer, and  security  procedures  in  general  use  by
  customers  and  receiving banks similarly situated. A security procedure
  is deemed to be commercially reasonable if (a)  the  security  procedure
  was  chosen  by  the  customer  after the bank offered, and the customer
  refused, a security procedure that was commercially reasonable for  that
  customer,  and  (b) the customer expressly agreed in writing to be bound
  by any payment order, whether or not authorized, issued in its name  and
  accepted by the bank in compliance with the security procedure chosen by
  the customer.
    (4)  The  term "sender" in this Article includes the customer in whose
  name a payment order is issued if the order is the authorized  order  of
  the  customer  under  subsection (1), or it is effective as the order of
  the customer under subsection (2).
    (5) This section applies to amendments and  cancellations  of  payment
  orders to the same extent it applies to payment orders.
    (6)  Except  as  provided  in  this  section  and  in paragraph (a) of
  subsection (l) of Section 4-A-203, rights and obligations arising  under
  this section or Section 4-A-203 may not be varied by agreement.