Section 2260.701 - Use of security proceduresIf there is a security procedure between the parties with respect to the electronic signature or electronic record, the following rules apply:
(1) The effect of compliance with a security procedure established by a law or regulation is determined by that law or regulation.(2) In all other cases, if the parties agree to use or otherwise knowingly adopt a security procedure to verify the person from which an electronic signature or electronic record has been sent, the electronic signature or electronic record is attributable to the person identified by the security procedure if the person relying on the attribution satisfies the burden of establishing that: (i) the security procedure was commercially reasonable;(ii) the party accepted or relied on the electronic message in good faith and in compliance with the security procedure and any additional agreement with or separate instructions of the other party; and(iii) the security procedure indicated that the electronic message was from the person to which attribution is sought.(3) If the electronic signature or electronic record is not attributable to a person under section 305 but would be attributable to the person under this section, the electronic signature or electronic record is nevertheless not attributable to the person under this section if the person satisfies the burden of establishing that the electronic signature or electronic record was caused directly or indirectly by a person: (i) that was not entrusted at any time with the right or duty to act for the person with respect to such electronic signature or electronic record or security procedure;(ii) that lawfully obtained access to transmitting facilities of the person if such access facilitated the misuse of the security procedure; or(iii) that obtained, from a source controlled by the person, information facilitating misuse of the security procedure. 1999, Dec. 16, P.L. 971, No. 69, § 701, effective in 30 days.