Not how the law works here - you're always liable in either case, but it is hoped that the message might prevent some cases of fraud. It's difficult to secure people against social engineering...