Unanticipated Risks in Payments Fraud: When Your Customer’s Insurance Company Comes Knocking

When a commercial customer loses money to a fraudulent wire transfer, insurance rarely ends the story. After paying the claim, the insurer acquires subrogation rights, which is the legal authority to pursue recovery from anyone who contributed to the loss, including the financial institution that processed the transfer. A resolved claim can become expensive litigation. This article examines insurer subrogation claims against financial institutions and proposes contract-based strategies to mitigate the risk.

The Fraud Landscape and the Rise of Insurance Coverage

Fraudulent funds transfers remain among the most significant operational risks facing financial institutions. In business email compromise (BEC) schemes, threat actors impersonate trusted parties and direct victims to wire funds to fraudulent accounts, generating billions of dollars in reported losses. Social engineering attacks and account takeover fraud have expanded the threat. Commercial customers, whose high wire and ACH volumes make them attractive targets, bear the brunt. Note that ACH transactions are governed by the Nacha Operating Rules, imposing a liability framework distinct from UCC Article 4A; detailed ACH analysis is beyond this article’s scope.

In response, more commercial customers carry cyber and crime insurance policies covering fraudulent funds transfer losses. These policies typically reimburse direct financial losses from computer fraud, funds transfer fraud, or social engineering. When a customer files a claim and the insurer pays, the customer’s immediate loss is resolved—but the insurer’s pursuit of recovery has just begun.

Subrogation: How an Insurance Payout Creates Bank Liability

Every state recognizes insurer subrogation rights, whether arising from equitable principles, express policy provisions, or statute. When an insurer pays a covered loss, it steps into the insured’s shoes and may pursue claims against third parties that caused or contributed to the loss, including the financial institution that processed the fraudulent transaction. The insurer’s rights are no greater, but also no less, than the customer’s. And insurers have the resources and sophistication to pursue those claims aggressively.

After paying a claim, insurers routinely investigate whether a third party bears responsibility. The investigation typically begins with the insurer or outside counsel contacting the bank with probing questions: What security procedures were in place? Did the bank verify the payment order before executing it? Were there red flags the bank failed to detect? Can the bank share its wire transfer policies? What did the bank do after learning of the fraud? Has the bank investigated, and can it share the results?

These inquiries, though framed as routine, warrant caution. A financial institution has no legal obligation to respond to informal inquiries from its customer’s insurer. The insurer is not a regulator and generally has no subpoena power absent litigation. The bank’s contractual relationship runs to the customer, not the insurer. And federal law prohibits disclosure of Suspicious Activity Reports and SAR-related information (31 U.S.C. § 5318(g)(2)), a prohibition that applies regardless of who requests the information.

Consult legal counsel before responding to any insurer inquiry. Carefully evaluate the scope and nature of the information requested.

Voluntary disclosure carries real risk. Beyond litigation exposure, disclosure of SAR-related information is a federal criminal violation. Information the bank provides may build the subrogation case against it. Descriptions of security procedures, internal investigations, or post-incident remediation may be characterized as evidence that the bank’s procedures were inadequate—or that it failed to meet its own standards.

Limited cooperation may be appropriate in some circumstances, where the customer itself requests information or where maintaining the relationship is a significant business consideration. Even then, manage responses carefully: have counsel review them and limit their scope. Avoid volunteering information beyond what is specifically requested; not all requested information needs to be provided. Consider whether responsive information is protected by attorney-client privilege, work product doctrine, or applicable bank secrecy or privacy laws.

The Legal Framework and the Insurer’s Litigation Advantage

Subrogation is the legal mechanism by which an insurer that has paid a claim steps into the insured’s shoes and pursues claims against responsible third parties. Courts consistently recognize subrogation as “the insurer’s right to be put in the position of the insured in order to pursue recovery from third parties who are responsible for the loss.” The legal basis varies by state: equitable subrogation arises by operation of law; conventional subrogation arises from express policy provisions. An insurer’s equitable subrogation rights generally accrue when it actually pays the loss—payment toward an actual claim, not a potential liability. Those rights are not unlimited, however. They remain subject to equitable constraints, including, in most states, the “made-whole” doctrine, under which the insured has priority to be fully compensated before the insurer recovers, absent a controlling contract term to the contrary.

Because subrogation is largely a matter of state law, its contours vary. States differ on the strength of the made-whole doctrine, on whether equitable defenses survive a policy’s subrogation clause, and on whether an insured can waive its insurer’s subrogation rights without the insurer’s consent. A bank operating in multiple states should not assume uniformity.

The subrogated insurer may assert claims under several theories. The most common claim arises under UCC Article 4A, which governs wire transfers and allocates liability based on whether the bank employed a “commercially reasonable security procedure” agreed to by the customer. Under § 4A-202, if the bank proves it used a commercially reasonable security procedure and acted in good faith and in compliance with it, the customer—not the bank—bears the loss, even if the payment order was unauthorized. Under § 4A-204, if the bank cannot meet this standard, it must refund the unauthorized transfer. Ensure that funds transfer agreements contain express customer acknowledgment that the offered security procedure is commercially reasonable. The insurer may also assert claims for common law negligence, breach of contract, or breach of fiduciary duty. But the insurer’s rights are no greater than the customer’s; the insurer is subject to the same defenses and limitations the bank could have asserted against the customer directly. This includes defenses based on the customer’s own negligence. If the customer failed to implement reasonable internal controls or disregarded the bank’s security recommendations, the insurer’s recovery may be reduced or barred under comparative or contributory negligence principles. This fact-intensive inquiry varies significantly by state.

Once paid, the commercial customer has little incentive to sue its bank. The insurer has every incentive to seek recovery. Insurance companies maintain dedicated subrogation departments, experienced litigation counsel, and the financial resources to pursue claims through trial and appeal. As claim payouts rise, insurers grow increasingly willing to target financial institutions—and these lawsuits pressure banks to strengthen security procedures. Even where the bank has strong defenses, defending a subrogation lawsuit is expensive, and the outcome is never certain. Note that statutes of limitation for subrogation claims vary by state and theory of recovery, and the limitations period generally runs from the date of the loss, not the date the insurer pays the claim. Timely assertion of limitations defenses can be outcome-determinative.

A Contract-Based Defense: The Subrogation Waiver

One effective defense is a contractual waiver of subrogation. Financial institutions can require commercial funds transfer customers to sign agreements waiving the customer’s insurer’s subrogation rights against the bank. Before implementing this strategy, determine whether subrogation waivers are enforceable in each operating jurisdiction.

Contractual waivers of subrogation are generally valid risk-allocation tools that do not violate public policy. Requiring the insurer itself to agree would be ideal but is often impractical. The critical question: Does a waiver signed by the insured (without the insurer’s consent) bind the insurer? A majority of courts say yes—a pre-loss contractual waiver between an insured and a third party is enforceable against the insurer, regardless of whether the insurer was a party to the agreement, had notice, or consented.

The majority rule rests on a straightforward principle: the insurer’s subrogation rights are derivative, not independent. Because the insurer steps into the insured’s shoes, it can acquire only those rights the insured possesses. When the insured contractually surrenders its right to sue the bank before any loss occurs, it has no cause of action at the time of the loss—and the insurer’s subrogation rights never arise.

A minority of jurisdictions hold that subrogation is the insurer’s own right, waivable only by the insurer itself. In those jurisdictions, a waiver by the insured without insurer consent may be unenforceable. Additionally, these minority jurisdictions construe waiver language strictly, so generic provisions may not reach the specific claims asserted. Confirm the applicable law in each state where the institution operates.

Complementary Strategy: Additional Insured Status

Beyond a subrogation waiver, financial institutions may require commercial customers to name the bank as an additional insured on their cyber or crime insurance policies. This approach triggers the “anti-subrogation rule” recognized in most states: an insurer cannot pursue subrogation claims against its own insured (including additional insureds under the same policy) for a loss arising from the very risk the policy covers. If the bank qualifies as an additional insured for funds-transfer fraud, the insurer’s subrogation claim may be barred entirely. The anti-subrogation rule’s scope varies by jurisdiction; confirm its applicability in each operating state. Many insurance policies do not permit additional insured status. Consult counsel before implementing this strategy and consider any state-law issues that may apply.

Two limits to consider: First, the protection reaches only as far as the coverage actually extended to the bank (an endorsement that excludes the bank’s own acts or omissions will not bar a claim premised on the bank’s own conduct) and, second, it operates only to the extent of the bank’s insurable interest. For that reason, additional-insured status is best used together with a waiver of subrogation: the waiver may bar the claim regardless of coverage scope, while additional-insured status adds a second, coverage-based bar.

Implementation Considerations

Consult legal counsel and payments operations teams to determine the appropriate scope and structure of waiver language, identify customer agreements into which it should be incorporated, and develop a communication strategy for existing customers. Tailor the waiver to the institution’s risk profile and the jurisdictions in which it operates.

Beyond the waiver itself, review the funds transfer agreement holistically. Key provisions include: express customer acknowledgment that the security procedure is commercially reasonable; a limitation of liability excluding consequential and indirect damages; affirmative customer obligations to maintain internal controls and promptly report suspicious activity; an indemnification clause covering defense costs in subrogation actions (drafted to complement, not contradict, the subrogation waiver); and a shortened claim-notice period layered on the statutory limitations period. These provisions collectively strengthen the bank’s position if a subrogation claim is asserted.

A waiver is only as good as its drafting and its fit with the customer’s policy. Financial institutions must consider the possibility (and effect) of situations where the customer contractually agrees to get a waiver of subrogation endorsement and fails to do so. Further, some courts construe waiver clauses strictly and will not extend them beyond their stated scope, so the waiver must expressly reach losses from funds-transfer and social-engineering fraud, not just “property damage.” Finally, financial institutions should consider implications if its customer’s policy prohibits or limits the customer’s ability to waive subrogation without the insurer’s consent. In other words, the absence of an insurer endorsement creates risk for the customer: the insurer may deny coverage on the ground that the insured breached the policy’s subrogation clause by waiving the insurer’s rights without permission.

Given the growing frequency of fraudulent funds transfer claims and the corresponding increase in subrogation activity, evaluate now whether to include a subrogation waiver in commercial customer agreements.

Some sophisticated customers will push back on a subrogation waiver. Insurers may refuse to provide an endorsement waiving subrogation. Be prepared to explain the rationale: the waiver allocates risk to the customer’s insurer, which has already accepted and priced the risk of funds transfer fraud. The waiver does not reduce the bank’s standard of care or eliminate the customer’s contractual remedies. It simply prevents the insurer from recovering from the bank what it has already agreed to cover. Coordinate with insurance advisors to ensure the waiver strategy is consistent with the bank’s own insurance program. The bank’s professional liability (E&O) or cyber insurance policies may provide defense and indemnity coverage for subrogation claims. Timely notice to the bank’s own insurers upon receiving any subrogation inquiry is essential to preserving coverage rights.

A waiver of subrogation should be one layer in a broader program. The bank’s first and strongest defense is the Article 4A security-procedure framework itself: offer, document, and obtain the customer’s written agreement to a commercially reasonable security procedure so that any resulting loss is allocated to the customer by statute. These defenses bind a subrogated insurer to the same extent they bind the customer. The payments fraud landscape continues to evolve, and so do insurers’ recovery strategies. Financial institutions that implement subrogation waivers, secure additional-insured status, strengthen security-procedure agreements, and manage insurer inquiries with appropriate caution will be better positioned to control this emerging exposure and protect the bottom line.