Wire Transfer Fraud and Business Email Compromise: Recovering Funds in California

Last updated: November 2026

A California business hit by wire transfer fraud, usually a spoofed email that caused it to wire money to a criminal, has three possible sources of recovery. They are the bank that sent the wire, the counterparty whose email was compromised, and the recipient of the funds. Which one pays depends on who authorized the transfer and whose security failed. California's version of UCC Article 4A, in Division 11 of the Commercial Code, governs the bank's liability. Kolmogorov Law, P.C. pursues civil recovery of wire fraud losses for businesses in Orange County and Los Angeles.

Call (909) 235-6116 or contact us online to discuss a wire your business sent to the wrong account.

The first 48 hours

Call the sending bank and ask it to initiate a recall through the receiving bank. Preserve the emails with full headers. Then report the loss to law enforcement; criminal reporting is a separate track from civil recovery and does not substitute for it.

Then start the civil analysis. The question is who had the duty, and who breached it.

Two kinds of wire transfer fraud, two different rules

In the first, the criminal gets into your own email or online banking and sends a wire instruction in your name. You never authorized it. This is an unauthorized payment order, and the bank's liability is governed by statute.

In the second, you received a convincing email, apparently from a vendor, telling you to send payment to a new account. You sent the wire yourself. This is an authorized payment order with a fraudulent beneficiary, and the bank is usually not liable. The claim runs against the party whose email was compromised or the party who received the funds.

Claims against your bank: unauthorized orders

If a bank accepts a payment order in your name that you did not authorize, the bank must refund the payment and pay interest, unless the order is "effective" against you under the statute. (Cal. U. Com. Code, § 11204, subd. (a).) That refund obligation cannot be varied by agreement. (Cal. U. Com. Code, § 11204, subd. (b).)

An unauthorized order becomes effective against the customer only under three conditions. The bank and customer agreed to a security procedure. The procedure was a commercially reasonable method of guarding against unauthorized orders. And the bank proves it accepted the order in good faith and in compliance with the procedure and any written instruction from the customer. (Cal. U. Com. Code, § 11202, subd. (b).) Commercial reasonableness is a question of law, decided by looking at the customer's expressed wishes, the size and frequency of its normal wires, and what similarly situated banks and customers use. (Cal. U. Com. Code, § 11202, subd. (c).)

A 2024 amendment closed a loophole. Requiring that a payment order come from a known email address, IP address, or telephone number "is not by itself a security procedure." (Cal. U. Com. Code, § 11201.) A bank that accepted a wire instruction because it arrived from your usual email has not, on that basis alone, met the statute.

Even where the procedure was reasonable and followed, the bank cannot keep the payment if the customer proves the order was not caused by an insider or by someone who obtained access to the customer's systems or security information. (Cal. U. Com. Code, § 11203, subd. (a)(2).)

Two deadlines. To preserve interest on the refund, notify the bank within a reasonable time not exceeding 90 days after you received notice that the order was accepted or your account was debited. (Cal. U. Com. Code, § 11204, subd. (a).) And a customer who does not object within one year after receiving notification of the payment is precluded from asserting that the bank was not entitled to retain it. (Cal. U. Com. Code, § 11505.)

Claims when you sent the wire yourself

When you authorized the wire, the bank's statutory liability largely disappears, with one exception worth checking. If the payment order named the beneficiary by both name and account number and the two did not match, the beneficiary's bank may rely on the number. But a nonbank originator who proves the account holder was not entitled to the payment is not obliged to pay the order. The exception is where the bank proves the originator had notice that payment might be made on the number alone. (Cal. U. Com. Code, § 11207, subds. (b), (c)(2).) Most wire agreements contain that notice.

The more productive claim is usually against the counterparty. Everyone is responsible for injury caused by want of ordinary care in the management of his property. (Civ. Code, § 1714, subd. (a).) A vendor whose email account was compromised because it used no multifactor authentication, ignored warnings, or let an attacker sit in its inbox for weeks has a negligence problem. Courts in these cases ask which party was in the better position to prevent the loss and whether each side followed reasonable verification practices. The outcome often turns on whether the "new account" email was answered with a phone call to a known number.

There is also the contract question. If you paid the criminal, did you pay the vendor? Usually not, which means the invoice is still unpaid and the vendor may sue you. Our data breach vendor obligations page covers the vendor's duties when its systems are breached.

Claims against the recipient

The account holder who received the funds is liable for conversion, and sometimes under the civil remedy for receiving stolen property, which allows treble damages. Our pages on conversion and Penal Code 496 explain those claims. The obstacle is that the recipient is often a money mule with nothing left. When funds are traceable to a solvent account, a prejudgment writ of attachment can freeze them.

What we do, and where these cases are heard

We obtain the bank's wire records and security agreement, the email headers from both sides, and any forensic report. Then we assign the loss under the statute and the negligence principles above. Many of these matters resolve with a negotiated split.

Cases are heard in the Superior Court: for Orange County, the Central Justice Center in Santa Ana; for Los Angeles, the Stanley Mosk Courthouse. Claims against national banks or out-of-state counterparties often proceed in the Central District of California. The business disputes hub describes the practice.

What to bring to the first meeting

The wire confirmation and the bank's account agreement, including any online banking or security procedure terms. The fraudulent emails with full headers, and the genuine emails they imitated. Any forensic findings about where the compromise occurred. The underlying contract or invoice with the counterparty.

Frequently asked questions

Is my bank liable for a fraudulent wire transfer?

If the wire was not authorized by you and the bank cannot show it followed a commercially reasonable security procedure in good faith, the bank must refund the payment with interest under California's Commercial Code. If you authorized the wire yourself based on a fraudulent email, the bank is generally not liable, and the claim runs against the counterparty or recipient.

Who is responsible when a vendor's email is hacked and I pay the wrong account?

It depends on whose carelessness allowed the loss. The vendor whose email was compromised may be negligent. The customer who did not verify new payment instructions by phone may share the fault. Separately, the vendor may still claim its invoice is unpaid, so both issues usually get resolved together.

Can I sue the person who received the money?

Yes, for conversion, and the civil remedy for receiving stolen property may allow treble damages. The difficulty is collection, because recipients are often intermediaries who moved the money within hours. A prejudgment attachment can freeze funds that remain in a traceable account.

How long do I have to report an unauthorized bank transfer?

Notify the bank immediately. To preserve interest on the refund, notice must be given within a reasonable time not exceeding 90 days after the bank notified you of the debit. A customer who does not object within one year after notification loses the right to challenge the bank's retention of the payment.

Talk to a California business litigation attorney

If your business lost funds to a fraudulent wire, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California.

This page provides general information about California law and is not legal advice. Outcomes depend on the bank agreement, the facts, and the court.