N.Y. U.C.C. 4-a-202

Section 4-A-202. Authorized and Verified Payment Orders.\n (1) A payment order received by the receiving bank is the authorized\norder of the person identified as sender if that person authorized the\norder or is otherwise bound by it under the law of agency.\n (2) If a bank and its customer have agreed that the authenticity of\npayment orders issued to the bank in the name of the customer as sender\nwill be verified pursuant to a security procedure, a payment order\nreceived by the receiving bank is effective as the order of the\ncustomer, whether or not authorized, if (a) the security procedure is a\ncommercially reasonable method of providing security against\nunauthorized payment orders, and (b) the bank proves that it accepted\nthe payment order in good faith and in compliance with the bank's\nobligations under the security procedure and any agreement or\ninstruction of the customer, evidenced by a record, restricting\nacceptance of payment orders issued in the name of the customer. The\nbank is not required to follow an instruction that violates an agreement\nwith the customer, evidenced by a record, or notice of which is not\nreceived at a time and in a manner affording the bank a reasonable\nopportunity to act on it before the payment order is accepted.\n (3) Commercial reasonableness of a security procedure is a question of\nlaw to be determined by considering the wishes of the customer expressed\nto the bank, the circumstances of the customer known to the bank,\nincluding the size, type, and frequency of payment orders normally\nissued by the customer to the bank, alternative security procedures\noffered to the customer, and security procedures in general use by\ncustomers and receiving banks similarly situated. A security procedure\nis deemed to be commercially reasonable if (a) the security procedure\nwas chosen by the customer after the bank offered, and the customer\nrefused, a security procedure that was commercially reasonable for that\ncustomer, and (b) the customer expressly agreed in a record to be bound\nby any payment order, whether or not authorized, issued in its name and\naccepted by the bank in compliance with the bank's obligations under the\nsecurity procedure chosen by the customer.\n (4) The term "sender" in this Article includes the customer in whose\nname a payment order is issued if the order is the authorized order of\nthe customer under subsection (1), or it is effective as the order of\nthe customer under subsection (2).\n (5) This section applies to amendments and cancellations of payment\norders to the same extent it applies to payment orders.\n (6) Except as provided in this section and in paragraph (a) of\nsubsection (l) of Section 4-A-203, rights and obligations arising under\nthis section or Section 4-A-203 may not be varied by agreement.\n