Who Pays When a Vendor Payment Is Diverted? US Liability Explained

Who pays when a vendor payment is diverted?

Usually, the business that sent the payment. If your own employee approved and sent money to a criminal's account, even because of a fake email, US law generally treats it as your payment. Banks are rarely required to refund it, and business accounts don't get the consumer protections people get on personal accounts.

There are exceptions. Who pays can depend on whether the payment was truly unauthorized, whether your bank followed its agreed security procedure, and whether your vendor's own mistakes helped the fraud happen. This guide walks through who bears the loss in payment diversion fraud for wires and ACH payments, what the rules actually say, and how to lower your exposure before it happens.

The stakes are high. Business email compromise (BEC), the FBI's category for these email scams, led to $3.05 billion in reported losses across 24,768 complaints in 2025, up from $2.77 billion in 2024, according to the FBI's 2025 Internet Crime Report.

Key takeaways

• If your own team sent the payment, US law usually treats it as yours, even if a fraudster tricked them.
• Under UCC Article 4A, banks generally have to refund only payments you never authorized.
• Regulation E's consumer protections don't cover business accounts.
• The fraudster's bank usually isn't liable unless it actually knew the name and account number didn't match.
• If your vendor's email was hacked, courts may split the loss based on who was in the best position to stop the fraud.
• Insurance helps only if your policy covers social engineering fraud, and many policies require a callback.

This article is general information, not legal advice. Talk to your lawyer about your own situation.

Is a payment authorized if a fraudster tricked your team?

The first question a bank asks after a diverted payment is simple: did your own team send it?

In most payment diversion fraud, the answer is yes. Nobody broke into your bank account. A fraudster sent an email that looked like it came from a real vendor, someone on your AP team updated the bank details, and someone with payment authority released the money. To the bank, that is an authorized payment. Your employee followed your own process, just with bad information.

An unauthorized payment is different. That is when someone gets into your online banking and sends money you never approved. US law gives you more protection there, though for businesses it still depends on your agreement with the bank.

	Authorized push payment (most vendor fraud)	Unauthorized payment (account takeover)
Who sent it	Your own employee, tricked by a fake request	A criminal using stolen logins or access
Typical scheme	Fake vendor email asking to change bank details	Hacked online banking, stolen tokens or credentials
Default loss under US rules	Usually the business that sent the payment	Can shift to the bank, depending on the security procedure and who caused the breach
Main rules	Your bank agreement, UCC Article 4A, Nacha rules	UCC 4A-202 to 4A-204, your bank agreement
Refund right	No general refund right for business payments	Possible, if the bank's security procedure or good faith falls short

This is why the same $200,000 loss can be your problem in one case and the bank's in another. It comes down to who pressed send, and what checks were in place when they did.

Who is liable for a fraudulent wire transfer under UCC 4A?

Business wire transfers in the US are governed by UCC Article 4A, which every state has adopted. It also covers most ACH payments a business sends to its vendors, since those count as "funds transfers" under UCC 4A-104 too.

Three parts of Article 4A matter most when a vendor payment is diverted.

1. If your employee sent it, it is your payment order. Under UCC 4A-202(a), a payment order is "the authorized order of the person identified as sender if that person authorized the order or is otherwise bound by it under the law of agency." In a vendor impersonation scheme, your own team approved and sent the payment, so it is your authorized order. The bank's security procedure did its job: it confirmed the order came from you. It was never designed to tell whether the bank details came from a fraudster.

2. Refunds apply to unauthorized orders, not tricked ones. When someone else sends a payment from your account, UCC 4A-202(b) can still make it your order if the security procedure is commercially reasonable and the bank "accepted the payment order in good faith and in compliance with the security procedure." If not, UCC 4A-204 requires the bank to refund it, as long as you report it "within a reasonable time not exceeding 90 days" after the bank notified you. There's also an exception under UCC 4A-203 if you can prove the fraud wasn't caused by someone you trusted with access or by information taken from a source you controlled. All of this is aimed at account takeover, not at a payment your own team approved.

3. The receiving bank can go by the account number. When the name on a wire and the account number do not match, UCC 4A-207(b)(1) says the beneficiary's bank "may rely on the number" and "need not determine whether the name and number refer to the same person." The exception is when that bank actually knows they point to different people. This is the rule that makes it so hard to recover money from the fraudster's bank. More on that below.

The short version: for a wire your team sent to a fake vendor account, Article 4A usually leaves the loss with you.

Can an ACH payment sent to a fraudster be pulled back?

Most vendor payments in the US go out by ACH, and the ACH network runs on the Nacha Operating Rules. People often assume an ACH payment can be pulled back if it turns out to be fraud. That is mostly not true for vendor payments.

• Reversals are for specific errors, and they rarely save a fraud loss. Under the Nacha rules, a sending business can reverse an ACH payment only for listed errors: a duplicate, an incorrect receiver, an incorrect amount or a wrong date. The reversal has to reach the receiving bank within five banking days, and Nacha treats a reversal sent for any other reason as improper. Even when a reversal is allowed, it pulls money back out of the receiving account, so it fails if the fraudster has already moved the funds.
• Your bank can ask, but the other bank doesn't have to give it back. Your bank can ask the receiving bank to return a payment for any reason. The receiving bank is not required to send it back. It has 10 banking days to respond, and by then the money is often gone.
• New fraud monitoring rules raise the bar for everyone. Nacha's fraud monitoring rules took effect in two phases in 2026, on March 20 and June 19. They require businesses that send ACH payments, and the banks involved, to have risk-based processes to spot payments made under false pretenses. Nacha's definition of false pretenses includes being misled about "the ownership of an account to be credited." One example Nacha gives of a reasonable process is change controls for vendor and payroll payment instructions.

Those rules don't create a new refund right. They do make it more likely that a bank, an insurer or a court will ask what your process was when a vendor's bank details changed. For a deeper look at the schemes themselves, see our guide to ACH fraud.

Why doesn't Regulation E protect business accounts?

If you've ever disputed a fraudulent charge on a personal account, you've used Regulation E. It caps what a person can lose on an unauthorized electronic transfer and gives them dispute rights. Many business owners assume something similar covers their company. It doesn't.

Regulation E only applies to consumer accounts. The rule defines an account as one "established primarily for personal, family, or household purposes" (12 CFR 1005.2(b)(1)), and a consumer as "a natural person" (1005.2(e)). A company operating account doesn't qualify, even for a sole owner. Wire transfers sit outside it as well: the CFPB's commentary notes Fedwire transfers are covered by Article 4A, not Regulation E.

So a business that loses money to a fake vendor has no federal consumer-style refund right to fall back on. What protects you is your bank agreement, Article 4A and your own controls.

Can you make the fraudster's bank pay?

It's natural to ask why the receiving bank didn't catch that the name on the payment and the account holder were different. Courts have mostly said that isn't the receiving bank's job.

The clearest recent example is Studco Building Systems v. 1st Advantage Federal Credit Union. A fraudster who had hacked into Studco's email impersonated a contact at its steel supplier and got Studco to pay four invoices, totaling over $550,000, by ACH to an account at a credit union. The account belonged to someone else, not the supplier. The credit union's system flagged name mismatches, but according to Woods Rogers' summary of the case, it produced "hundreds to thousands of warnings related to mismatched names on a daily basis" and nobody reviewed them.

A trial court found the credit union liable. In 2025 the US Court of Appeals for the Fourth Circuit reversed. Under UCC 4A-207, the receiving bank can rely on the account number unless it has actual knowledge that the name and number belong to different people. Alerts that nobody reviewed weren't enough to count as actual knowledge.

That doesn't mean you should skip calling the receiving bank. The FBI's advice is blunt: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds." Moving fast is still the best chance of freezing whatever is left. But a lawsuit against the fraudster's bank is a hard path, and it usually isn't a recovery plan.

You vs your vendor: who pays when the vendor's email was hacked?

Sometimes the fraud didn't start on your side. The vendor's own email gets hacked, and the fake bank details arrive from a real address in the middle of a real thread. You pay the fraudster, and your vendor says the invoice is still unpaid. Who eats it?

There is no single federal rule. It usually comes down to your contract with the vendor and state law, and courts look hard at who was in the best position to stop the fraud.

A well-known example is Beau Townsend Ford Lincoln v. Don Hinds Ford (6th Cir. 2018). A hacker got into a Beau Townsend sales manager's email and sent Don Hinds fake wiring instructions, and Don Hinds "wired the $736,225 to the hacker." The trial court put the whole loss on the buyer. The Sixth Circuit reversed and sent the case back, borrowing from the UCC's check impostor rule the idea that "losses attributable to fraud should be borne by the party in the best position to prevent the fraud." A court would "have to determine whether either Beau Townsend's or Don Hinds' failure to exercise ordinary care contributed to the hacker's success," and then split the loss by comparative fault.

That decision was unpublished, so other courts don't have to follow it. But it shows how these fights tend to go. Both sides will be asked:

• Did the vendor know, or should it have known, its email was compromised?
• Did the vendor warn customers how it would and wouldn't change bank details?
• Did the payer verify the change through a channel the fraudster didn't control?
• Were there red flags, like urgency, a new bank, or a new country, that someone ignored?

The practical takeaway: a payer that verified the change outside of email is in a much stronger spot than one that didn't. If you're a vendor, telling customers up front that you'll never change bank details by email alone helps you too.

Does insurance cover a diverted vendor payment?

Sometimes, but don't assume it. Whether a policy pays depends on its exact wording, and insurers and businesses have fought over this in court for years.

• Crime policies often cover employee theft and forgery. Some exclude losses where your own employee voluntarily sent the money, which is exactly what happens in vendor fraud.
• Social engineering or funds transfer fraud endorsements are written for this scenario. They often come with lower sublimits and conditions, such as a requirement that you verified the change request with a callback before paying.
• Cyber policies vary widely. Some cover social engineering losses, some don't, and some only cover the cost of responding to the breach.

Courts don't always side with the insurer. In American Tooling Center v. Travelers (6th Cir. 2018), a fraudster impersonating a Chinese vendor told the company to pay a different account "due to an audit." The company sent about $834,000 before it caught on. The Sixth Circuit held the loss was covered under the policy's computer fraud provision, finding that "the computer fraud 'directly caused' ATC's 'direct loss.'" Other courts reading other policies have reached the opposite result, so the wording of your policy matters more than any single case.

Two things to do now, before a loss: ask your broker whether your policy covers social engineering fraud and for how much, and read any verification conditions closely. If your policy requires a callback and your team skipped it, the claim may be denied.

How can you reduce your share of the loss?

Since the law usually leaves the loss with the business that paid, the best protection is the process you run before the money moves. The same steps also put you in a better spot with your bank, your insurer and, if it comes to it, your vendor.

1. Never accept bank detail changes by email alone. Treat any request to change where a vendor gets paid as unverified until it's confirmed another way.
2. Verify through a channel the requester didn't give you. Use a verified secure channel if you have one. If you don't, call the vendor back on a phone number you already had on file, never the one in the email.
3. Hold the first payment to new details. Add a short hold or a second approval on the first payment after any change, and watch for urgency, a new bank or a new country.
4. Separate duties. The person who changes vendor bank details shouldn't be the person who releases the payment.
5. Keep a record of every check. Write down who verified the change, how and when. If you ever end up in a dispute, that record is your evidence of ordinary care.
6. Use your bank's fraud tools. Ask about positive pay, payee name checks and dual approval for wires.
7. Know your first hour. If a payment goes to the wrong account, call your bank right away, ask it to recall the funds and contact the receiving bank, then report it to the FBI's IC3. In 2025, the FBI's Recovery Asset Team froze $679 million in fraudulent transfers, a 58% success rate. Speed is what makes that possible.

For a step-by-step version, use our checklist for verifying a vendor bank detail change.

How does Coffr help prevent diverted payments?

Coffr helps businesses confirm that a vendor's bank account really belongs to that vendor before money moves. Vendors share their details through a secure flow instead of email, ownership is verified, and every verification is recorded on an immutable blockchain ledger. That gives your team a clear record of who verified what and when.

Coffr doesn't change who's liable under the law, and it doesn't recover lost funds. What it does is make it much harder for a fraudster's bank details to reach your payment run in the first place.

Talk with us to see how it fits your AP process.

Sources

• UCC 4A-104: Funds transfer definitions, Cornell LII
• UCC 4A-202: Authorized and verified payment orders, Cornell LII
• UCC 4A-203: Unenforceability of certain verified payment orders, Cornell LII
• UCC 4A-204: Refund of payment and duty of customer to report, Cornell LII
• UCC 4A-207: Misdescription of beneficiary, Cornell LII
• 12 CFR 1005.2: Regulation E definitions, CFPB
• Nacha Operating Rules, Nacha
• Beau Townsend Ford Lincoln v. Don Hinds Ford, No. 17-4177 (6th Cir. 2018), Justia
• Depository institution not liable in ACH fraud case (Studco v. 1st Advantage FCU), Woods Rogers
• American Tooling Center v. Travelers, No. 17-2014 (6th Cir. 2018), Justia
• FBI Internet Crime Report 2025, FBI IC3

This article is general information, not legal advice. Laws and court decisions vary by state and change over time. Talk to your lawyer about your own situation.