Article 4A is not a consumer protection statute. It assumes two sophisticated parties and asks a narrow question after a loss: did the bank and customer agree on a security procedure, was that procedure commercially reasonable, and did the bank accept the payment order in good faith and in compliance with it.
If those conditions are met, the loss generally rests with the customer even when the payment order was fraudulent. This is why the details of the agreed procedure, and evidence that it was actually followed, matter more than the sophistication of the attack.
Common questions
Not directly. It allocates the loss, and the allocation usually favors the bank when a commercially reasonable agreed security procedure was followed.
It is assessed against the customer's circumstances, including the size and frequency of payments and the alternatives the bank offered, so it varies by relationship rather than being a fixed checklist.
Sources and further reading
Citing this entry? Cite as Coffr, LLC and link to https://getcoffr.com/glossary/uniform-commercial-code-4a.