(a) If a receiving bank accepts a payment order issued in the name of its customer as sender which is (i) not authorized and not effective as the order of the customer under § 36-4A-202, or (ii) not enforceable, in whole or in part, against the customer under § 36-4A-203, the bank shall refund any payment of the payment order received from the customer to the extent the bank is not entitled to enforce payment and shall pay interest on the refundable amount calculated from the date the bank received payment to the date of the refund. However, the customer is not entitled to interest from the bank on the amount to be refunded if the customer fails to exercise ordinary care to determine that the order was not authorized by the customer and to notify the bank of the relevant facts within a reasonable time not exceeding ninety days after the date the customer received notification from the bank that the order was accepted or that the customer’s account was debited with respect to the order. The bank is not entitled to any recovery from the customer on account of a failure by the customer to give notification as stated in this section.

(b) Reasonable time under subsection (a) may be fixed by agreement as stated in § 36-1-302(b), but the obligation of a receiving bank to refund payment as stated in subsection (a) may not otherwise be varied by agreement.