(a) If an accepted payment order was transmitted pursuant to a security procedure for the detection of error and the payment order (i) erroneously instructed payment to a beneficiary not intended by the sender, (ii) erroneously instructed payment in an amount greater than the amount intended by the sender, or (iii) was an erroneously transmitted duplicate of a payment order previously sent by the sender, the following rules apply:

(1) If the sender proves that the sender or a person acting on behalf of the sender pursuant to Code Section 11-4A-206 complied with the security procedure and that the error would have been detected if the receiving bank had also complied, the sender is not obliged to pay the order to the extent stated in paragraphs (2) and (3).

(2) If the funds transfer is completed on the basis of an erroneous payment order described in clause (i) or (iii) of subsection (a), the sender is not obliged to pay the order and the receiving bank is entitled to recover from the beneficiary any amount paid to the beneficiary to the extent allowed by the law governing mistake and restitution.

(3) If the funds transfer is completed on the basis of a payment order described in clause (ii) of subsection (a), the sender is not obliged to pay the order to the extent the amount received by the beneficiary is greater than the amount intended by the sender. In that case, the receiving bank is entitled to recover from the beneficiary the excess amount received to the extent allowed by the law governing mistake and restitution.

(b) If (i) the sender of an erroneous payment order described in subsection (a) is not obliged to pay all or part of the order, and (ii) the sender receives notification from the receiving bank that the order was accepted by the bank or that the sender's account was debited with respect to the order, the sender has a duty to exercise ordinary care, on the basis of information available to the sender, to discover the error with respect to the order and to advise the bank of the relevant facts within a reasonable time, not exceeding 90 days, after the bank's notification was received by the sender. If the bank proves that the sender failed to perform that duty, the sender is liable to the bank for the loss the bank proves it incurred as a result of the failure, but the liability of the sender may not exceed the amount of the sender's order.

(c) This Code section applies to amendments to payment orders to the same extent it applies to payment orders.