June 2026 OBA Legal Briefs

June 24, 2026

LEGAL update

	643 N.E. 41^st
	Oklahoma City, OK 73105
	Phone: 405-424-5252
	Toll free: 866-424-5252
	Fax: 405-424-4518
ccompliance@oba.com	www.oba.com
	*WE MAKE BANKERS BETTER*

June 2026

The “Authorized” Fraud Dilemma in Real-Time Payments
Update to May Article re: Interim Final Order
Changes in Uniform Consumer Credit Code Amounts effective 7/1/26

By Scott Thompson

The “Authorized” Fraud Dilemma in Real-Time Payments

For decades, the legal relationship between a community bank and its depositor regarding fraud was governed by a relatively stable binary: the transaction was either authorized or it wasn’t. If a fraudster hacked into an account and moved money, it was “unauthorized,” and the bank generally bore the loss under the Electronic Fund Transfer Act (EFTA) and Regulation E. If the customer made the transfer themselves, they “authorized” it, and the loss stayed with them.

But in 2026, that binary is crumbling. The rise of real-time payment (RTP) rails like FedNow and The Clearing House’s RTP network, combined with increasingly sophisticated “social engineering” scams, has created a legal gray area that is rapidly becoming a primary source of litigation and regulatory scrutiny for community banks. As these systems reach mass adoption, the “speed of business” has inadvertently become the “speed of fraud.” For a community banker, the legal question is no longer just “did the customer push the button?” but rather “was that button-push legally valid if it was induced by deception?”

The Statutory Framework: EFTA vs. UCC Article 4A

To understand the current crisis, one must look at the two primary statutes governing funds transfers. The Electronic Fund Transfer Act (15 U.S.C. § 1693 et seq.), implemented by Regulation E, covers “electronic fund transfers” (EFTs) for consumer accounts. For decades, Section 903(11) of the EFTA has defined an “unauthorized electronic fund transfer” as one initiated by a person other than the consumer without actual authority. Crucially, official commentary to Regulation E has traditionally noted that if a consumer is induced by a fraudster to provide account credentials, the resulting transfer is unauthorized. However, if the consumer themselves initiates the transfer—even under the influence of a scammer—banks have historically argued this falls outside the definition of “unauthorized.”

Parallel to this is Article 4A of the Uniform Commercial Code (UCC), which generally governs commercial wire transfers and has traditionally been the shield for banks in the “Authorized Push Payment” (APP) context. Under UCC § 4A-202, a payment order is “authorized” if the person identified as the sender actually authorized it or is otherwise bound by the law of agency.

The tension in 2026 lies in plaintiffs’ attorneys attempting to pull transactions that were once considered UCC 4A “wire transfers” into the more consumer-friendly EFTA/Regulation E regime. The most significant crack in the bank’s traditional defense appeared in the case New York v. Citibank, N.A. (S.D.N.Y. 2024/2025). The New York Attorney General sued Citibank, alleging the bank failed to protect customers from online fraud. Citibank argued that wire transfers are expressly excluded from the EFTA. However, the court rejected a categorical exclusion. The New York theory, which has gained traction in 2026, breaks a transfer into three phases:

The customer sends instructions to the bank.
The bank-to-bank transfer occurs.
The payee’s bank credits the recipient.

The court suggested that while the “bank-to-bank” leg (Phase 2) is exempt from the EFTA, the “consumer-to-bank” instruction (Phase 1) is not. As the court noted in its 2025 ruling:

“If the bank-to-bank leg were truly a standalone transfer, it would not be a consumer transfer at all… rendering the EFTA’s wire transfer carve-out superfluous.”

For community banks, this is a seismic shift. It means that the high-level protections of UCC 4A may no longer apply to the initial stage of a consumer initiating a transfer via a mobile app or online portal. A key focus for 2026 is the “duty of investigation.” The Second Circuit is currently reviewing whether the EFTA imposes a duty on banks to investigate the legitimacy of a transfer, rather than just the authenticity of the credentials used. If the court finds such a duty exists, the “he pushed the button” defense will be legally obsolete.

2026 Nacha Rule Changes: The “False Pretenses” Standard

The banking industry’s own self-regulatory body, Nacha, has recognized this shift. As of March 20, 2026, new Nacha Operating Rules have gone into effect that explicitly define “False Pretenses” as a new fraud category. This rule change is significant because it requires both Originating Depository Financial Institutions (ODFIs) and Receiving Depository Financial Institutions (RDFIs) to perform risk-based monitoring for payments where the customer appears to authorize the transaction but does so after someone has misrepresented their identity or authority.

Under these 2026 rules:

ODFIs must monitor all outgoing ACH payments for both unauthorized activity and False Pretenses.
RDFIs must monitor incoming credits for “mule activity,” such as sudden high-velocity credits to a dormant account.

These changes represent a shift from passive processing to active policing. Effective March 20, 2026, Phase 1 of the new Nacha fraud monitoring rules went live for high-volume originators. By June 19, 2026, Phase 2 extends these requirements to all remaining ACH originators and Third-Party Senders, regardless of volume. This means every community bank, as an ODFI (Originating Depository Financial Institution), must now ensure its business customers have “commercially reasonable” fraud detection.

Defining “False Pretenses”

The most critical addition to the 2026 Nacha Rulebook is the explicit inclusion of “False Pretenses.” Under the updated rules, an “unauthorized entry” now includes those initiated under fraudulent inducement. Specifically, the rules now state that participants must implement:”…risk-based processes and procedures to identify ACH credit Entries initiated due to fraud, including those initiated under False Pretenses.” This effectively codifies the “Authorized Push Payment” (APP) fraud dilemma. For the first time, Nacha is requiring banks to monitor not just for “hacked” accounts, but for “tricked” customers.

Standardized Entry Descriptions

To assist in this monitoring, Nacha now requires standardized Company Entry Descriptions for specific types of high-risk transactions. Starting in 2026, all ACH payroll credits must use the description “PAYROLL”, and all online consumer debits for e-commerce must use “PURCHASE”. This standardization is designed to allow automated AI tools to flag “out-of-pattern” transactions—such as a “PAYROLL” file originating from a customer who has never processed payroll before.

While Nacha rules do not technically shift legal liability in the same way a statute does, they set the industry “standard of care.” In a courtroom, a community bank that fails to implement Nacha’s “False Pretenses” monitoring may find it impossible to argue they acted with “ordinary care” under the UCC or “reasonableness” under a UDAAP analysis.

III. Real-Time Payments: The “Seconds to Midnight” Process

The operational process of a FedNow or RTP transaction can create a legal vulnerability. In a traditional ACH environment, there is a “settlement window.” If a customer realizes they were scammed at 10:00 AM, the bank often has until the end of the day (or the next) to claw back the file.

In the real-time environment:

Initiation: Customer enters the recipient’s alias (email or phone number).
Validation: The system confirms the alias is linked to a valid account.
Clearing and Settlement: The funds move and settle instantly. The “Credit Transfer Message” is sent, and the Receiving Bank must make funds available to the recipient immediately.

Legal liability often hinges on the “Commercially Reasonable Security Procedure” mentioned in UCC § 4A-202(c). Moving forward, simply requiring a password and a texted MFA code may, at some point, no longer be considered “commercially reasonable” for high-speed rails. Courts have begun looking at the issue of “out-of-band” authentication and “behavioral biometrics” (e.g., detecting if a customer is on a phone call while initiating a transfer, which is a common sign they are being coached by a scammer). What is held to be a commercially reasonable security procedure is evolving.

Mitigation Strategies for 2026 and Beyond

To navigate this landscape, community banks may want to focus on four specific areas:

The “Informed Authorization” Workflow

Consider a move away from a simple “Submit” button. Implement a “Speed Bump” for any transfer to a first-time recipient or for an amount over a certain threshold. This speed bump may require the customer to affirmatively click “No” to a series of specific prompts, such as: “Has someone from the ‘Bank Security Department’ told you to move this money?” Documentation of these specific denials provides a robust defense against “fraudulent inducement” claims.

Revising “Ordinary Care” Definitions

Under the UCC, a bank must act with “ordinary care.” Ensure your internal manuals define ordinary care in the context of RTP. This includes documented training for wire room staff on recognizing “coached” customers and the use of modern fraud-scoring tools that analyze the recipient account (the “mule” side), not just the sender’s credentials.

Contractual Clarity and UDAAP Compliance

Review your Terms and Conditions for any language that claims the bank is “never liable” for authorized transfers. Such absolute language is a UDAAP magnet. Instead, use language that aligns with Regulation E while clearly outlining the customer’s duty to verify the identity of the recipient.

The “Mule” Investigation Duty

Under the new Nacha 2026 rules, your duty as a Receiving Bank (RDFI) may have increased. If your bank is used as a pass-through for a “mule” account and you fail to flag the suspicious inflow of credits, you could face “interbank” liability or regulatory fines, even if the fraud didn’t originate with your customer.

Conclusion

The legal concept that a “button push” always equals “consent” is dying. In the real-time world of 2026, community banks must recognize that authorization is a process, not a single act. By aligning operational “friction” with the evolving standards of the EFTA and Nacha, banks can provide the speed customers want without bearing the total cost of the fraud that speed enables. The goal for the banker is to ensure that when a fraud event occurs, the bank can prove it provided not just a fast rail, but a guarded one.

Update to last month’s article – Interim Final Rule and Interim Final Order

If you read last month’s article, and I know you did, it addressed a new Interim Final Rule (“IFR”) and Interim Final Order (“IFO”) from the OCC which were designed to directly address the order of the Northern District of Illinois which had found that the Illinois Interchange Fee Prohibition Act (“IFPA”) was not pre-empted by the National Banking Act.

Since the issuance of the IFR and IFO, the Seventh Circuit Court of Appeals, where an appeal of the Illinois decision was pending, has remanded back to the Northern District of Illinois to determine the effect of the OCC’s actions on the district court’s initial decision. On June 1, 2026, the district court issued a new order. After analyzing the IFR and IFO in light of its previous ruling, the district court came to the conclusion that IFPA does conflict with and is an obstacle to the accomplishment and execution of the full purpose and objectives of the powers of a national bank, as those powers have now been defined by the changes made to federal regulations pursuant to the IFR. In light of that conclusion, the Northern District of Illinois found the National Banking Act preempts the IFPA and issued a permanent injunction prohibiting enforcement of the IFPA as to national banks, federal savings associations, payment card networks and out-of-state chartered state banks. While the state of Illinois will presumably appeal to the Seventh Circuit once again, their appeal stands on much thinner ice.

Also of note, Colorado passed a bill similar to the IFPA just after the OCC issued the IFR and IFO. Getting the bill through the state senate required some shenanigans. For example, when the bill looked to be headed for defeat in committee, senate leadership swapped out a committee member who opposed the bill for the bill’s author, giving the bill just enough votes to pass. It then passed on the senate floor by one vote, with at least one senator claiming that she was told her bill would be killed if she voted against the interchange bill. The bill now sits with Governor Polis who will have to decide if he wants to drag Colorado into the same mess as Illinois, particularly in light of the OCC’s actions and the current state of the IFPA.

Changes in Uniform Consumer Credit Code Amounts effective 7/1/26

By Pauli Loeffler

Sec. 1-106 of the Oklahoma Uniform Consumer Credit Code in Title 14A (the “U3C”) makes certain dollar limits subject to change when there are changes in the Consumer Price Index for Urban Wage Earners and Clerical Workers as compiled by the Bureau of Labor Statistics, U.S. Department of Labor. You can download and print the notification from the Oklahoma Department of Consumer Credit by at this link (. It is also accessible on the OBA’s Legal Links page under Resources once you create an account through the My OBA Member Portal. You can access the Oklahoma Consumer Credit Code with regard to changes in dollar amounts for prior years on that page as well.

Increased Late Fee

The maximum late fee that may be assessed on a consumer loan is the greater of (a) five percent of the unpaid amount of the installment or (b) the dollar amount provided by rule of the Administrator for this section pursuant to § 1-106. As of July 1, 2026, the amount provided under (b) will increase by $1.00 to $34.00.

Late fees for consumer loans must be disclosed under both the UC3 and Reg Z, and the consumer must agree to the fee in writing. Any time a loan is originated, deferred, or renewed, the bank has the opportunity to obtain the borrower’s written consent to the increased late fee as set by the Administrator of the Oklahoma Department of Consumer Credit. However, if a loan is already outstanding and is not being modified or renewed, a bank has no way to unilaterally increase the late fee amount if it states a specific amount in the loan agreement.

On the other hand, the bank may take advantage of an increase in the dollar amount for late fees if the late-fee disclosure is properly worded, such as:

“If any installment is not paid in full within ten (10) days after its scheduled due date, a late fee in an amount which is the greater of five percent (5%) of the unpaid amount of the payment or the maximum dollar amount established by rule of the Consumer Credit Administrator from time to time may be imposed.”

3-508A. This section of the “U3C” sets the maximum annual percentage rate for certain loans. It provides three tiers with different rates based on unpaid principal balances that may be “blended” based on the amount of the loan under (a):

(a) the total of:

(i) thirty-two percent (32%) per year on that part of the unpaid balances of the principal which is 7,000.00 or less;

(ii) twenty-three percent (23%) per year on that part of the unpaid balances of the principal which is $7,000.01 but does not exceed ($11,000.00); and

(iii) twenty percent (20%) per year on that part of the unpaid balances of the principal which is more than $11,000.01.

It also has an alternative maximum rate that may be used rather than blending the rates under 2. (b): “twenty-five percent (25%) per year on the unpaid balances of the principal.

The amounts under each tier are NOT subject to annual adjustment by the Administrator of the Oklahoma Department of Consumer Credit under §1-106. However, subsection (4) added in 2022 allows the lender to charge a closing fee which IS subject to adjustment under § 1-106. The closing fee which was $190.41 has increased as follows:

(4) In addition to the loan finance charge permitted in this section and other charges permitted in this act, a supervised lender may assess a lender closing fee not to exceed One Hundred Ninety Dollars and Forty-One Cents ($196.18) upon consummation of the loan.

Note that the closing fee is NOT a finance charge under the OK U3C, and therefore not considered for purposes of usury. However, the fee IS a finance charge under Reg Z. Most banks use Reg Z disclosures. This means that it is possible that the fee under Reg Z disclosures will cause the APR to exceed the usury rate under § 3-508A. If that happens, document the file to show that the fee is excluded under the U3C in order to show the loan does not in fact violate Oklahoma’s usury provisions. Please note that the bank is NOT required to charge a closing fee at all, and banks may choose to not charge the fee at all or charge less than the amount permitted under the statute.

3-508B Loans

Some banks make small consumer loans based on a special finance-charge method that combines an initial “acquisition charge” with monthly “installment account handling charges,” rather than using the provisions of § 3-508A with regard to maximum annual percentage rate.

The permitted principal amounts for § 3-508B is adjusting from $3,660.00 to $3,750.00 for loans consummated on and after July 1, 2026.

Sec. 3-508B provides an alternative method of imposing a finance charge to that provided for Sec. 3-508A loans. Late or deferral fees and convenience fees as well as convenience fees for electronic payments under § 3-508C are permitted, but no other fees can be imposed. No insurance charges, application fees, documentation fees, processing fees, returned check fees, credit bureau fees, nor any other kind of fee is allowed. No credit insurance even if it is voluntary can be sold in connection with § 3-508B loans. If a lender wants or needs to sell credit insurance or to impose other normal loan charges in connection with a loan, it will have to use § 3-508A instead. Existing loans made under § 3-508B cannot be refinanced as or consolidated with or into § 3-508A loans, nor vice versa.

On loans having a principal of Three Thousand Seven Hundred Sixty Dollars ($3,750.00) or less, a supervised lender may charge in lieu of the loan finance charges specified in Section 3-508Aof this title, the following amounts:
On any amount up to and including $202.43, there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, a handling charge may be added at the ratio of $6.59 for each $32.94 of principal,
on any loan in an amount in excess of $202.43 up to and including the amount of $236.25, there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, an installment account handling charge shall be allowed not to exceed $9.76 per month,
on any loan of an amount in excess of 230.58 but not more than Four Hundred Sixty- $461.16), there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, an installment account handling charge shall be allowed not to exceed $23.63 per month,
on any loan of an amount in excess of $461.17 but not in excess $658.80, there shall be allowed an acquisition charge for making the loan, not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, an installment account handling charge shall be allowed $27.00.
on any loan in an amount in excess of $658.80 up to and including the amount of $988.20, there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, an installment account handling charge shall be allowed not to exceed $38.65 per month,
on any loan in an amount in excess $1,012,50 but not more than $1,317.60, there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, an installment account handling charge shall be allowed not to exceed $37.13
on any loan of an amount in excess of $1,350.01 but not more than $1,647.00, there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, an installment account handling charge shall be allowed not to exceed $32.94 per month,
on any loan of an amount in excess of One Thousand Nine Hundred Seventy-Six and Forty Cents ($1,647.00) but not more than One Thousand Nine Hundred Seventy-Six Dollars and Forty Cents ($1,976.40), there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of the principal. In addition thereto, an installment account handling charge shall be allowed not to exceed Forty Dollars and Fifty-Three Cents ($40.50) per month,
on any loan of an amount in excess of than One Thousand Nine Hundred Seventy-Six Dollars and Forty Cents ($1,976.40) but not more than Two Thousand Four Hundred Forty-Four Dollars ($2,500.00), there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of principal. In addition thereto, an installment account handling charge shall be allowed not to exceed Fifty Dollars ($50.00) per month,
on any loan of an amount in excess but not more than Two Thousand Four Hundred Forty-Four Dollars ($2,440.00), but not more than Three Thousand Fifty Dollars ($3,050.00) there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of principal. In addition thereto, an installment account handling charge shall be allowed not to exceed Sixty-One Dollars ($61.00) per month, and an
on any loan of an amount in excess of Three Thousand Fifty Dollars ($3,050.00) but not more than Three Thousand One Hundred Twenty-Five Dollars ($3,125.00), there shall be allowed an acquisition charge for making the loan not in excess of one-tenth (1/10) of the amount of principal. In addition thereto, an installment account handling charge shall be allowed not to exceed Seventy-Five Dollars ($75.00) per month.
The maximum term of any loan made under the terms of this section shall be one (1) month for each Ten Dollars ($10.00) of principal up to a maximum term of eighteen (18) months. Provided, however, that under subparagraphs e through i of paragraph 1 of this section the maximum terms shall be one (1) month for each Twenty Dollars ($20.00) of principal up to a maximum term of eighteen (18) months, and under subparagraphs j and k of paragraph 1 of this section, the maximum terms shall be one (1) month for each Twenty Dollars ($20.00) of principal to a maximum term of twenty-four (24) months.
The minimum term of any loan made under the terms of subparagraphs a through k of paragraph 1 of this section shall be no less than sixty (60) days. Any loan made under the terms of this section shall be scheduled to be payable in substantially equal installments at not less than thirty-day intervals, with the first installment to be scheduled to be due not less than one (1) calendar month after the date such loan is made.
Loans made under this section may be refinanced or consolidated according to the provisions of this section, notwithstanding anything in Section 2-101et seq. of this title to the contrary. When a loan made under this section is refinanced or consolidated, installment account handling charges on the loans being refinanced or consolidated must be rebated pursuant to the provisions regarding rebate on prepayment (Section 3-210 of this title) as of the date of refinancing or consolidation. For the purpose of determining the amount of acquisition and installment account handling charges permitted in relation to the refinancing or the consolidation of loans made under this section, the principal resulting from the refinancing or consolidation is the total of the unpaid balances of the principal of the loans being refinanced or consolidated, plus any new money advanced, and any delinquency or deferral charges if due and unpaid, less any unearned acquisition and installment account handling charges imposed in connection with loans being refinanced or consolidated.
On such loans under this section, no insurance charges or any other charges of any nature whatsoever shall be permitted.
Except as otherwise provided, the acquisition charge authorized herein shall be deemed to be earned at the time a loan is made and shall not be subject to refund. Provided, however, in a loan made under this section which is prepaid in full, refinanced or consolidated within the first sixty (60) days, the acquisition charge under this section will not be fully earned at the time the loan is made, but must be refunded pro rata at the rate of one-sixtieth (1/60) of the acquisition charge for each day from the date of the prepayment, refinancing or consolidation to the sixtieth day of the loan. On the prepayment of any loan under this section, the installment account handling charge shall be subject to the provisions of Section 3-210of this title as it relates to refunds. Provisions of Section 3-203of this title as it relates to delinquency charges and Section 3-204 of this title as it relates to deferral charges shall apply to loans made under the section.

Note if a loan is prepaid, the installment account handling charge shall also be subject to refund. A Monthly Refund Chart for handling charges for prior years can be accessed on the page indicated above, as well as § 3-508B Loan Rate (APR) Table. I expect the charts and table for 2025 to be added shortly.

3-511 Loans

I frequently get calls when lenders receive a warning from their loan origination systems that a loan may exceed the maximum interest rate. Nearly always, the banker says the interest rate does not exceed the alternative non-blended 25% rate allowed under § 3-508A according to their calculations. Usually, the cause for the red flag on the system is § 3-511. This is another section for which loan amounts may adjust annually. Here is the section with the amounts as effective for loans made on and after July 1, 2025 in bold type.

Supervised loans, not made pursuant to a revolving loan account, in which the principal loan amount is $6,800.00 or less and the rate of the loan finance charge calculated according to the actuarial method exceeds eighteen percent (18%) on the unpaid balances of the principal, shall be scheduled to be payable in substantially equal installments at equal periodic intervals except to the extent that the schedule of payments is adjusted to the seasonal or irregular income of the debtor; and

(a) over a period of not more than forty-nine (49) months if the principal is more than $2,040.00, or

(b) over a period of not more than thirty-seven (37) months if the principal is $2,040.00 or less.

The reason the warning has popped up is due to the italicized language: The small dollar loan’s APR exceeds 18%, and it is either single pay or interest-only with a balloon.

Dealer Paper “No Deficiency” Amount

If dealer paper is consumer-purpose and is secured by goods having an original cash price less than a certain dollar amount, and those goods are later repossessed or surrendered, the creditor cannot obtain a deficiency judgment if the collateral sells for less than the balance outstanding. This is covered in Section 5-103(2) of the U3C. This dollar amount was previously $6,00.00 and increases to $6,600.00 on July 1, 2025.