One of our customers mailed a check to a vendor that was intercepted by a rogue postal employee who then generated their own check and forged our customer’s signature. The forged check was used to open a fraudulent account at another bank and cleared our bank. Our customer notified us of the fraud outside of the Federal Reserve’s return window but within the thirty-day window for customer notifications under our account agreement. Are we liable for the full amount of the check? Do we have any recourse against the depository bank? We had advised the customer to pay this vendor electronically rather than mailing a check.

We believe that your bank likely is liable for the full amount of the check since your customer reported the fraud within your account agreement’s reporting deadline. Whether your bank has any recourse for the check depends on whether the depository bank breached a presentment warranty to your bank or your customer’s negligence substantially contributed to the making of the forged check.

Under the UCC, your customer must promptly notify your bank of any unauthorized payments that appear on an account statement. Although the UCC requires customers to report an unauthorized payment within one year after a statement showing the unauthorized payment is made available to them, banks may narrow this timeframe by the terms of their account agreements. It appears your account agreement narrowed the reporting window to thirty days; however, your customer’s notification within this window was timely. As a result, we believe you likely will need to reimburse your customer for the check (subject to their negligence as discussed below), since they alerted you to the fraud with “reasonable promptness.”

The UCC does not require your bank to reimburse a customer for a forged signature on a check if the customer’s own negligence substantially contributed to the forgery (provided that your bank exercised ordinary care and acted in good faith in paying the check). However, except in an extreme case (such as a business that keeps blank checks and a rubber signature stamp in an unlocked desk drawer), it can be difficult to prove that a customer’s negligence substantially contributed to a forgery. In this case, even though you advised your customer to make an electronic payment, it is unlikely that a court would find that the act of placing a check in the mail was negligent.

Regarding your ability to recover the lost funds, your bank would have a claim against the depository bank only if that bank breached one of the UCC presentment warranties. When the depository bank presented the checks to your bank, it made three presentment warranties under the UCC: (1) there were no unauthorized or missing endorsements on the checks, (2) the checks had not been altered, and (3) the depository bank did not know that the drawer’s signature was forged. It is unlikely that the depository bank breached any of these warranties, unless you can prove that it knew the check was forged when it was presented to your bank.

Finally, we note that your bank should assess whether a suspicious activity report (SAR) should be filed in relation to the forged check. The FDIC regulations require you to file a SAR if your loss aggregates more than $5,000 and there is an identified suspect involved in the suspicious activity, or if the total loss aggregates to $25,000 or more, regardless of potential suspects.

For resources related to our guidance, please see:

Illinois UCC, 810 ILCS 5/3-401 (“A person is not liable on an instrument unless (i) the person signed the instrument . . . .”)

Illinois UCC, 810 ILCS 5/4-406(c) (“[T]he customer must exercise reasonable promptness in examining the statement . . . . If, based on the statement or items provided, the customer should reasonably have discovered the unauthorized payment, the customer must promptly notify the bank of the relevant facts.”)

Illinois UCC, 810 ILCS 5/4-406(f) (“Without regard to care or lack of care of either the customer or the bank, a customer who does not within one year after the statement or items are made available to the customer. . . . discover and report the customer’s unauthorized signature on or any alteration on the item is precluded from asserting against the bank the unauthorized signature or alteration.”)

Illinois UCC, 810 ILCS 5/4-103(a) (“The effect of the provisions of this Article may be varied by agreement, but the parties to the agreement cannot disclaim a bank’s responsibility for its lack of good faith or failure to exercise ordinary care or limit the measure of damages for the lack or failure. However, the parties may determine by agreement the standards by which the bank's responsibility is to be measured if those standards are not manifestly unreasonable.”)

Illinois UCC, 810 ILCS 5/3-406(a) (“A person whose failure to exercise ordinary care substantially contributes to an alteration of an instrument or to the making of a forged signature on an instrument is precluded from asserting the alteration or the forgery against a person who, in good faith, pays the instrument or takes it for value or for collection.”)

Illinois UCC, 810 ILCS 5/3-406(b) (“Under subsection (a), if the person asserting the preclusion fails to exercise ordinary care in paying or taking the instrument and that failure substantially contributes to loss, the loss is allocated between the person precluded and the person asserting the preclusion according to the extent to which the failure of each to exercise ordinary care contributed to the loss.”)

UCC § 3-406, Comment 3 (“The following cases illustrate the kind of conduct that can be the basis of a preclusion under Section 3-406(a):

Case #1. Employer signs checks drawn on Employer’s account by use of a rubber stamp of Employer’s signature. Employer keeps the rubber stamp along with Employer’s personalized blank check forms in an unlocked desk drawer. An unauthorized person fraudulently uses the check forms to write checks on Employer’s account. The checks are signed by use of the rubber stamp. If Employer demands that Employer’s account in the drawee bank be recredited because the forged check was not properly payable, the drawee bank may defend by asserting that Employer is precluded from asserting the forgery. The trier of fact could find that Employer failed to exercise ordinary care to safeguard the rubber stamp and the check forms and that the failure substantially contributed to the forgery of Employer’s signature by the unauthorized use of the rubber stamp

Illinois UCC, 810 ILCS 5/3-417(a) and 810 ILCS 5/4-208(a) (“Presentment warranties. (a) If an unaccepted draft is presented to the drawee for payment or acceptance and the drawee pays or accepts the draft, (i) the person obtaining payment or acceptance, at the time of presentment, and (ii) a previous transferor of the draft, at the time of transfer, warrant to the drawee making payment or accepting the draft in good faith that: (1) the warrantor is or was, at the time the warrantor transferred the draft, a person entitled to enforce the draft or authorized to obtain payment or acceptance of the draft on behalf of a person entitled to enforce the draft; (2) the draft has not been altered; and (3) the warrantor has no knowledge that the signature of the purported drawer of the draft is unauthorized.”)

Illinois UCC, 810 ILCS 5/3-417(b) and 810 ILCS 5/4-208(b) (“A drawee making payment may recover from any warrantor damages for breach of warranty equal to the amount paid by the drawee less the amount the drawee received or is entitled to receive from the drawer because of the payment. In addition the drawee is entitled to compensation for expenses and loss of interest resulting from the breach. The right of the drawee to recover damages under this subsection is not affected by any failure of the drawee to exercise ordinary care in making payment. If the drawee accepts the draft, breach of warranty is a defense to the obligation of the acceptor. If the acceptor makes payment with respect to the draft, the acceptor is entitled to recover from any warrantor for breach of warranty the amounts stated in this subsection.”)

FDIC Suspicious Activity Report Rules, 12 CFR 353.3(a) (“A bank shall file a suspicious activity report . . . in the following circumstances: (2) Transactions aggregating $5,000 or more where a suspect can be identified. . . . (3) Transactions aggregating $25,000 or more regardless of potential suspects.”)