Section 4-A-202. An authorized order of a customer identified as sender, but is effective as an order of the customer pursuant to subsection (2) of Section 4-A-202, the following rules apply: (a) By express written agreement, the receiving bank may limit the extent to which it is entitled to enforce or retain payment of the payment order

(b) The  receiving  bank  is  not  entitled  to enforce or retain
             payment of the payment order if the customer proves that  the
             order was not caused, directly or indirectly, by a person (i)
             entrusted  at  any  time  with duties to act for the customer
             with respect to payment orders or the security procedure,  or
             (ii)  who  obtained  access to transmitting facilities of the
             customer or who obtained, from a  source  controlled  by  the
             customer   and  without  authority  of  the  receiving  bank,
             information facilitating breach of  the  security  procedure,
             regardless of how the information was obtained or whether the
             customer  was  at  fault.    Information  includes any access
             device, computer software, or the like.
    (2) This section applies to amendments of payment orders to  the  same
  extent it applies to payment orders.