(1) If an accepted payment order is not, under § 47-4A-202(a), an authorized order of a customer identified as sender, but is effective as an order of the customer pursuant to § 47-4A-202(b), the following rules apply: By express written agreement, the receiving bank may limit the extent to which it is entitled to enforce or retain payment of the payment order; and
(2) The receiving bank is not entitled to enforce or retain payment of the payment order if the customer proves that the order was caused, directly or indirectly, by a person:
(3) This section applies to amendments of payment orders to the same extent it applies to payment orders.
Entrusted with duties to act for the receiving bank with respect to payment orders or the security procedure; or
Who obtained access to communications facilities of the receiving bank or who obtained, from a source controlled by the receiving bank and without authority of the customer, information facilitating breach of the security procedure, regardless of how the information was obtained. Information includes any access device, computer software, or the like.