Com. Code, § 11204

(a) If a receiving bank accepts a payment order issued in the name of its customer as sender which is (i) not authorized and not effective as the order of the customer under Section 11202, or (ii) not enforceable, in whole or in part, against the customer under Section 11203, the bank shall refund any payment of the payment order received from the customer to the extent the bank is not entitled to enforce payment and shall pay interest on the refundable amount calculated from the date the bank received payment to the date of the refund. However, the customer is not entitled to interest from the bank on the amount to be refunded if the customer fails to exercise ordinary care to determine that the order was not authorized by the customer and to notify the bank of the relevant facts within a reasonable time not exceeding 90 days after the date the customer received notification from the bank that the order was accepted or that the customer’s account was debited with respect to the order. The bank is not entitled to any recovery from the customer on account of a failure by the customer to give notification as stated in this section.

(b) Reasonable time under subdivision (a) may be fixed by agreement as stated in subdivision (b) of Section 1302, but the obligation of a receiving bank to refund payment as stated in subdivision (a) may not otherwise be varied by agreement.