If an escrow agent wrongly sends money to a cyber criminal, the agent will probably be liable for the loss. But what if one of the parties to the escrow, the buyer for instance, is duped by a cyber scam? Is the escrow company on the hook for that? A buyer in Wisconsin says yes.The buyer, Geils Home Wisconsin, LLC, was trying to purchase a house in Milwaukee. Geils hired a closing agent, Merit Title, to complete the deal. According to the lawsuit that Geils later filed, a Merit Title employee sent closing and wiring instructions to Geils through unsecure email attachments. A month later, a fraudster emailed Geils from a similar account, except the crook used one fewer “t” in the domain name “merittitle.” The phony email contained wiring instructions mimicking those in Merit Title’s earlier missive. Geils fell for it and wired $162,000 to the scammer. Geils later discovered the fraud and was able to recover half of the money. Geils then sued Merit Title for the remainder. In the lawsuit, Geils alleges that Merit Title knew about the likelihood of wire fraud and failed to take reasonable steps to protect Geils from that possibility.

From a legal perspective, it’s not clear to me that Merit Title owed a duty to protect Geils against that company’s own employees falling victim to internet scams. But it’s also not an implausible argument. (Geils’s own negligence also contributed to the loss.) And even if Geils’s argument is not a winner right now, the law will likely evolve to embrace that position.

So what’s a responsible escrow company to do? First, it’s not enough to educate your own employees. You must also warn your customers about tricks that cyber criminals might play on them. That might not be a legal requirement, but it’s certainly a best practice. Second, make sure to set up a secure and verifiable method for transmitting wiring instructions. And, by all means, take special precautions for changing wiring instructions. That’s the point at which the escrow process is the most vulnerable. If Merit Title had done those things, it would likely have avoided this lawsuit.