1. If an accepted payment order is not, under subsection 1 of section 41-04.1-10, an authorized order of a customer identified as sender, but is effective as an order of the customer under subsection 2 of section 41-04.1-10, the following rules apply: a. By express agreement evidenced by a record, the receiving bank may limit the extent to which it is entitled to enforce or retain payment of the payment order. b. The receiving bank is not entitled to enforce or retain payment of the payment order if the customer proves that the order was not caused, directly or indirectly, by a person entrusted at any time with duties to act for the customer with respect to payment orders or the security procedure or by a person who obtained access to transmitting facilities of the customer or who obtained, from a source controlled by the customer and without authority of the receiving bank, information facilitating breach of the security procedure, regardless of how the information was obtained or whether the customer was at fault. Information includes any access device, computer software, or the like. 2. This section applies to amendments of payment orders to the same extent it applies to payment orders.
41-04.1-12. (4A-204) Refund of payment and duty of customer to report with respect to unauthorized payment order. 1. If a receiving bank accepts a payment order issued in the name of its customer as sender which is not authorized and not effective as the order of the customer under section 41-04.1-10 or is not enforceable, in whole or in part, against the customer under section 41-04.1-11, the bank shall refund any payment of the payment order received from the customer to the extent the bank is not entitled to enforce payment and shall pay interest on the refundable amount from the date the bank received payment to the date of the refund. However, the customer is not entitled to interest from the bank on the amount to be refunded if the customer fails to exercise ordinary care to determine that the order was not authorized by the customer and to notify the bank of the relevant facts within a reasonable time not exceeding ninety days after the date the customer received notification from the bank that the order was accepted or that the customer's account was debited with respect to the order. The bank is not entitled to any recovery from the customer because of a failure by the customer to give notification as stated in this section. 2. Reasonable time under subsection 1 may be fixed by agreement under subsection 1 of section 41-01-16, but the obligation of a receiving bank to refund payment as stated in subsection 1 may not otherwise be varied by agreement.