1. Can a Business Recover Money Lost to a Smishing Scam?
A business may recover stolen funds through a bank refund, successful payment recall, insurance coverage, or a claim against a responsible party. The available route depends on whether an outsider initiated the transfer or an authorized employee sent money after being deceived.
Unauthorized Transfers and Bank Liability
New York UCC Article 4-A governs qualifying funds transfers, including many commercial wire transfers. Its application must be established before relying on its refund provisions.
Under §4-A-202, a payment order is authorized if the customer approved it or is bound under agency law. An otherwise unauthorized order may still be effective against the customer if the bank proves that an agreed security procedure was commercially reasonable and that it accepted the order in good faith while complying with the procedure and applicable customer instructions.
Section 4-A-203 provides a separate defense for certain verified but unauthorized orders. The customer may defeat enforcement by proving that the fraud did not originate, directly or indirectly, from specified entrusted persons or customer-controlled access or information sources.
If an order is neither authorized nor enforceable, §4-A-204 generally requires the receiving bank to refund the payment to the extent it cannot enforce it, together with applicable interest. Disputes over authentication logs and bank compliance may lead to banking litigation.
Payments Approved by Deceived Employees
Suppose an employee receives a text impersonating a supplier and transfers money to a substituted bank account. The payment may remain legally authorized even though the employee was deceived.
Article 4-A does not provide an automatic refund for an authorized payment induced by fraud. Businesses should examine the employee's authority, altered payment instructions, applicable bank obligations, and possible claims against other participants.
Where the dispute involves a business ACH payment, debit transaction, or another payment method, different rules or agreements may govern. The federal Electronic Fund Transfer Act and Regulation E generally protect consumer accounts rather than ordinary commercial accounts.
2. Which Smishing Scam Losses Can Be Recovered?
The stolen payment is usually the starting point, but a business may also incur investigation costs, account restoration expenses, and operational losses. Recovering those additional amounts requires an applicable legal basis and evidence connecting each expense to the misconduct.
Direct Financial Losses and Recovery Expenses
Businesses should separate the missing funds from expenses incurred after discovering the attack.
| Loss Category | Recovery Considerations |
|---|---|
| Fraudulent transfers | Statutory refund rights, payment recovery, or claims against responsible parties |
| Forensic investigation | Documented costs recoverable under an applicable cause of action or policy |
| Account restoration | Reasonable expenses subject to contractual and legal limitations |
| Business interruption | Proven losses meeting causation, foreseeability where applicable, and reasonable-certainty requirements |
Fraudulent transfers
- Recovery ConsiderationsStatutory refund rights, payment recovery, or claims against responsible parties
Forensic investigation
- Recovery ConsiderationsDocumented costs recoverable under an applicable cause of action or policy
Account restoration
- Recovery ConsiderationsReasonable expenses subject to contractual and legal limitations
Business interruption
- Recovery ConsiderationsProven losses meeting causation, foreseeability where applicable, and reasonable-certainty requirements
Section 4-A-204 provides specific refund and interest remedies, not general compensation for business interruption or investigation expenses. Additional fraud victim claims require a legally supported theory of recovery, and Article 4-A may limit inconsistent common-law claims.
Proving the Amount of Financial Damage
Transaction statements identify missing funds. Forensic invoices, payment records, and accounting documents help establish the cost of responding to the incident.
A claim for lost revenue requires more than projected sales figures. Contracts, canceled orders, historical earnings, and financial records must support the alleged loss, its causal connection to the fraud, and a reasonably certain calculation. Any recovered funds or insurance payments must also be accounted for.
3. What Should a Business Do Immediately after a Smishing Attack?
Contacting the sending bank promptly offers the best practical opportunity to pursue an available payment recall or recovery request. Businesses should also secure compromised systems and preserve transaction records before routine data retention processes erase important evidence.
First Steps to Protect Funds and Evidence
A business responding to a fraudulent transfer should:
- Notify its bank immediately and request an available recall, fraud alert, or recovery action.
- Disable compromised credentials and secure affected accounts.
- Preserve fraudulent texts, URLs, payment instructions, and authentication logs.
- Document when the fraud was discovered and every communication with financial institutions.
- Notify relevant insurers within policy deadlines and review any applicable incident-reporting duties.
A recall request does not compel the receiving bank to reverse a completed transfer. The business should also consider promptly reporting the incident to the FBI's Internet Crime Complaint Center (IC3), which may help coordinate efforts to identify or freeze traceable funds.
Bank Notification Deadlines under Article 4-a
Two statutory notice provisions require particular attention.
Under New York UCC §4-A-204, a customer who fails to exercise ordinary care to detect an unauthorized payment order and notify the bank within a reasonable period, not exceeding 90 days after receiving the specified bank notification, may lose the statutory interest entitlement on a qualifying refund.
Separately, §4-A-505 generally precludes a customer from disputing the bank's right to retain payment unless the customer objects within one year after receiving notification reasonably identifying the payment order.
These periods serve different purposes and are not general lawsuit-filing deadlines. Account agreements may impose additional notice requirements, while any lawsuit remains subject to its applicable filing rules.
4. What Can Prevent Recovery after a Fraudulent Transfer?
Even when a business establishes that a scam occurred, disagreements may arise over payment authorization, the bank's security procedures, insurance exclusions, and responsibility for the loss. Transaction details often determine whether a recovery claim has a viable legal foundation.
Authentication Records and Employee Authority
A stolen password does not resolve whether a payment order was legally authorized or enforceable. Banks and customers may dispute login histories, multifactor authentication records, security alerts, agreed verification requirements, and access granted to employees.
Supplier impersonation or falsified payment instructions may also support a separate business fraud claim against identifiable wrongdoers. Such misconduct does not, by itself, establish liability against the sending bank.
Insurance Exclusions and Recovery Restrictions
Cyber policies may distinguish computer fraud, funds-transfer fraud, and social engineering. Coverage can differ substantially when an employee voluntarily approves a fraudulent payment rather than an outsider initiating the transfer.
The policy's insuring agreements, endorsements, exclusions, notice provisions, and applicable limits must be reviewed before calculating an expected insurance recovery. Businesses should also avoid pursuing duplicate compensation for the same financial loss.
5. Frequently Asked Questions
Some cyber policies cover qualifying fraudulent transfers, but coverage is not automatic. A policy may treat employee-authorized payments differently from transfers initiated by unauthorized outsiders. The wording of the coverage grant, exclusions, limits, and reporting requirements controls the claim.
The FBI may assist with efforts to identify or freeze fraud proceeds through IC3 and participating financial institutions. However, reporting a scam does not guarantee that the funds will be returned. Businesses should contact their bank immediately and report the incident promptly rather than waiting for a criminal investigation.
19 Oct, 2026
