UCC 4-406: Duty to Examine Bank Statements and Report Forgeries

Your duty to examine bank statements and report forgeries comes from UCC 4-406, and it runs on two clocks. You have to look at each statement promptly after the bank makes it available, and you have to tell the bank about any forged signature or altered check you spot. Miss the window on a repeat forger and you eat every later check they cash. Miss one year on any forgery and the claim is gone for good.¹

What the Bank Has to Give You Before Your Clock Starts

Your duty is triggered by the bank doing its part first. Under UCC 4-406(a), the bank must return your paid checks or send you enough information to identify each one that cleared. At a minimum, that means the check number, amount, and date paid.¹ Most banks now post images of cleared checks in the online portal instead of mailing originals. The statute treats “sends or makes available” the same way, so once the statement posts, the clock is running whether you log in or not.

Reviewing With Reasonable Promptness

UCC 4-406(c) requires you to examine the statement with reasonable promptness to spot payments you did not authorize, meaning forged signatures or checks altered to change the amount or the payee.¹ You are not expected to run a forensic audit. You are expected to compare what cleared against what you actually wrote. A $500 check showing up as $5,000, or a check number you never issued, is the kind of thing the statute assumes you will catch.

Glancing at the balance is not enough. Letting statements stack up unopened is worse. If the information the bank gave you would have revealed the problem on a normal review, you are treated as if you saw it.

The 30-Day Rule for Repeat Forgeries

Under UCC 4-406(d)(2), if the same person forges more than one check and you fail to catch the first one within a reasonable time, capped at 30 days from when the statement was available, you lose the right to recover on every later forgery by that same wrongdoer, as long as the bank paid those later checks in good faith before you gave notice.¹

The logic is simple. Serial forgery is the usual pattern. An employee, relative, or roommate who takes one check tends to take more. If you had reported the first, the bank could have frozen the account and stopped paying. Your silence cost the bank the chance to prevent the later losses, so those losses shift to you.

This is where most customers actually lose their claims. The first forged check is often small enough to slip past a casual review. By the time the amounts get large enough to notice, the 30 days on the earlier statement have already run.

The One-Year Absolute Cutoff

UCC 4-406(f) sets a hard outer limit. You must discover and report any unauthorized signature or alteration within one year of when the statement was made available, or you cannot assert the claim against the bank at all.¹ This applies regardless of whether you were careless, whether the bank was careless, or whether you had a realistic way of finding the problem sooner. Courts treat it as a statute of repose, so discovery arguments and tolling theories do not save a late claim.

What Missing the Deadline Actually Costs

Under UCC 4-406(d)(1), if the bank shows that you failed to review promptly and that its own loss came from your delay, you are barred from recovering on that item.¹ The bank’s loss is usually the chance it lost: freezing the account, stopping payment on later checks, or chasing the forger while the trail was still warm.

On a single forgery, the bank has to prove your delay actually hurt it. On repeat forgeries by the same person, the shift is automatic once the 30 days pass on the first statement. And after one year, every unreported check is closed off, no matter what.

When the Bank Shares the Loss

Even a late report is not always fatal. UCC 4-406(e) applies a comparative fault rule: if you prove the bank failed to exercise ordinary care in paying the item and that failure contributed to the loss, the loss is split between you and the bank in proportion to fault.¹

What counts as ordinary care tracks banking industry practice. Automated check processing without manual signature review is standard, so skipping the visual check is generally not negligence. Ignoring obvious red flags is a different story: a check to an employee for an amount far outside normal payroll, or a signature that plainly does not match, can put the bank on the hook for not asking questions.

Bad faith is the stronger fact. If you can prove the bank did not pay the item in good faith, the preclusion rules in subsection (d) do not apply at all, and the full loss stays with the bank no matter how late your report.¹ The bar is high, but it matters in insider-fraud cases.

Your Deposit Agreement Probably Gives You Less Time

The UCC lets banks and customers vary most of its rules by agreement. Under UCC 4-103, the bank can change the standards governing your account as long as the changes are not manifestly unreasonable.² Deposit agreements routinely use this to shorten the one-year reporting window to 60 or even 30 days, and courts have generally upheld those clauses. One decision found that cutting the window from a year to 60 days was not manifestly unreasonable because 60 days was still enough time to review a statement.

There are limits. The agreement cannot waive the bank’s duty of good faith or ordinary care.² But the deadlines are fair game. Read the contract. If it says 60 days, the one-year statutory backstop will not rescue you.

Debit Card and ACH Fraud Are a Different Rule

UCC 4-406 covers paper checks. Unauthorized debit card charges, ATM withdrawals, and ACH debits are governed by Regulation E, which sets its own timelines and caps consumer liability at $50 within two business days of learning of the loss, $500 if reported within 60 days of the statement, and unlimited amounts for transfers occurring more than 60 days after the statement if the bank shows timely notice would have prevented them.³ If both types of fraud hit your account, treat them as separate claims under separate rules.

Reporting the Forgery

Speed beats paperwork. Call the bank as soon as you spot the problem. A phone call is notice under the UCC and stops the clock; the written claim can follow.

When you file formally, the bank will typically ask for the account number and the check numbers, dates, and amounts of the forged items, along with a notarized affidavit of forgery declaring you did not authorize the transactions and got no benefit from them. Notary fees run roughly $2 to $25 depending on the state. The fraud department will also want a signature sample, and most banks require a police report. Under the Fair Credit Reporting Act, businesses that took the fraudulent payments can require a police report before turning over transaction records tied to identity theft.⁴

Deliver in person if you can, so you walk out with confirmation. If you mail, use certified mail with return receipt, because the date the bank received your notice is the date that will matter if anyone argues over a deadline. Ask for a claim number and keep it, along with copies of every document you submit and notes on every call, with names and dates. That record is what protects you if the claim is denied and you have to escalate.

1
Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
2
Legal Information Institute. UCC 4-103 – Variation by Agreement; Measure of Damages; Action Constituting Ordinary Care
3
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
4
Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft