CO Code § 4-4.5-204 (2021)
2021 Colorado Code|Title 4 - Uniform Commercial Code|Article 4.5 - Funds Transfers|Part 2 - Issue and Acceptance of Payment Order|§ 4-4.5-204. Refund of Payment and Duty of Customer to Report With Respect to Unauthorized Payment Order

  If a receiving bank accepts a payment order issued in the name of its customer as sender which is (i) not authorized and not effective as the order of the customer under section 4-4.5-202, or (ii) not enforceable, in whole or in part, against the customer under section 4-4.5-203, the bank shall refund any payment of the payment order received from the customer to the extent the bank is not entitled to enforce payment and shall pay interest on the refundable amount calculated from the date the bank received payment to the date of the refund. However, the customer is not entitled to interest from the bank on the amount to be refunded if the customer fails to exercise ordinary care to determine that the order was not authorized by the customer and to notify the bank of the relevant facts within a reasonable time not exceeding ninety days after the date the customer received notification from the bank that the order was accepted or that the customer's account was debited with respect to the order. The bank is not entitled to any recovery from the customer on account of a failure by the customer to give notification as stated in this section.    Reasonable time under subsection (a) of this section may be fixed by agreement as stated in section 4-1-205, but the obligation of a receiving bank to refund payment as stated in subsection (a) of this section may not otherwise be varied by agreement.     History. Source: L. 90: Entire article added, p. 346, § 1, effective January 1, 1991. L. 2006: (b) amended, p. 497, § 30, effective September 1.    OFFICIAL COMMENT   1. With respect to unauthorized payment orders, in a very large percentage of cases a commercially reasonable security procedure will be in effect. Section 4A-204 applies only to cases in which (i) no commercially reasonable security procedure is in effect, (ii) the bank did not comply with a commercially reasonable security procedure that was in effect, (iii) the sender can prove, pursuant to Section 4A-203(a)(2). that the culprit did not obtain confidential security information controlled by the customer, or (iv) the bank, pursuant to Section 4A-203(a) (1) agreed to take all or part of the loss resulting from an unauthorized payment order. In each of these cases the bank takes the risk of loss with respect to an unauthorized payment order because the bank is not entitled to payment from the customer with respect to the order. The bank normally debits the customer's account or otherwise receives payment from the customer shortly after acceptance of the payment order. Subsection (a) of Section 4A-204 states that the bank must recredit the account or refund payment to the extent the bank is not entitled to enforce payment.   2. Section 4A-204 is designed to encourage a customer to promptly notify the receiving bank that it has accepted an unauthorized payment order. Since cases of unauthorized payment orders will almost always involve fraud, the bank's remedy is normally to recover from the beneficiary of the unauthorized order if the beneficiary was party to the fraud. This remedy may not be worth very much and it may not make any difference whether or not the bank promptly learns about the fraud. But in some cases prompt notification may make it easier for the bank to recover some part of its loss from the culprit. The customer will routinely be notified of the debit to its account with respect to an unauthorized order or will otherwise be notified of acceptance of the order. The customer has a duty to exercise ordinary care to determine that the order was unauthorized after it has received notification from the bank, and to advise the bank of the relevant facts within a reasonable time not exceeding 90 days after receipt of notification. Reasonable time is not defined and it may depend on the facts of the particular case. If a payment order for $1,000,000 is wholly unauthorized, the customer should normally discover it in far less than 90 days. If a $1,000,000 payment order was authorized but the name of the beneficiary was fraudulently changed, a much longer period may be necessary to discover the fraud. But in any event, if the customer delays more than 90 days the customer's duty has not been met. The only consequence of a failure of the customer to perform this duty is a loss of interest on the refund payable by the bank. A customer that acts promptly is entitled to interest from the time the customer's account was debited or the customer otherwise made payment. The rate of interest is stated in Section 4A-506. If the customer fails to perform the duty, no interest is recoverable for any part of the period before the bank learns that it accepted an unauthorized order. But the bank is not entitled to any recovery from the customer based on negligence for failure to inform the bank. Loss of interest is in the nature of a penalty on the customer designed to provide an incentive for the customer to police its account. There is no intention to impose a duty on the customer that might result in shifting loss from the unauthorized order to the customer.