NOT RECOMMENDED FOR PUBLICATION File Name: 25a0587n.06
Case No. 25-1163
UNITED STATES COURT OF APPEALS FOR THE SIXTH CIRCUIT
FILED
Dec 18, 2025
COFFEE CAPITAL & DEVELOPMENT, ) KELLY L. STEPHENS, Clerk )
LLC, )
Plaintiff - Appellant, )
ON APPEAL FROM THE UNITED )
v. STATES DISTRICT COURT FOR THE )
EASTERN DISTRICT OF MICHIGAN )
RPT RESTAURANT ACCOUNTING ) SERVICES, LLC, OPINION )
Defendant - Appellee. )
)
Before: NALBANDIAN, MATHIS, and RITZ, Circuit Judges.
RITZ, J., announced the judgment of the court and delivered an opinion, in which NALBANDIAN and MATHIS, JJ., concurred in part. NALBANDIAN (pp. 12–20) and MATHIS (pp. 21–22), JJ., delivered separate opinions concurring in part and concurring in the judgment.
RITZ, Circuit Judge. Coffee Capital & Development, LLC, hired RPT Restaurant Accounting Services, LLC, to perform various financial services, including third-party cash transfers. RPT erroneously transferred over $100,000 from Coffee Capital’s accounts to a fraudster. When RPT refused to reimburse Coffee Capital, Coffee Capital sued for negligence. The district court granted summary judgment to RPT, finding that RPT owed no duty to Coffee Capital separate and distinct from the contract. Coffee Capital now appeals. We affirm.
BACKGROUND
In 2021, Coffee Capital and RPT entered into a written agreement under which Coffee Capital authorized RPT to transfer money from Coffee Capital’s accounts to third parties. This dispute began when a third-party fraudster hacked RPT and Coffee Capital’s email exchanges.
After reading Coffee Capital’s legitimate emails asking RPT to transfer funds to third-party accounts, the fraudster emailed RPT, impersonating a Coffee Capital principal, and requested that RPT transfer $103,490.21 from Coffee Capital’s account to the fraudster. RPT transferred the funds.
After the fraudster requested a second transfer, RPT contacted Coffee Capital, and both parties became aware of the fraud. When RPT refused to reimburse Coffee Capital for its loss, Coffee Capital terminated the parties’ agreement and sued RPT for negligence. Notably, Coffee Capital did not include a breach-of-contract claim in its complaint.
RPT removed the dispute to federal court because Coffee Capital is a Michigan company, RPT is a Wisconsin company, and the amount in controversy exceeded $75,000. See 28 U.S.C. § 1332. RPT also filed a motion for summary judgment, arguing that the parties’ pre-existing agreement precluded recovery in tort because Coffee Capital had not identified a separate and distinct non-contractual duty owed by RPT. RPT suggested that Coffee Capital brought a claim in tort only because the agreement expressly cabined RPT’s contractual liability to a small amount.
The district court granted RPT’s motion, finding that “Coffee Capital ha[d] not identified any common law duty imposed on RPT under Michigan law that is separate and distinct from the contract.” RE 37, Op. & Ord., PageID 210-11. Coffee Capital timely appealed.
ANALYSIS
I. The standard of review is de novo.
We review a district court’s summary judgment decision de novo. Trs. of Resilient Floor Decorators Ins. Fund v. A & M Installations, Inc., 395 F.3d 244, 247 (6th Cir. 2005). Summary judgment requires the movant, who bears the initial burden of proof, to “show[] that there is no genuine dispute as to any material fact and [that] the movant is entitled to judgment as a matter of
3
law.” Fed. R. Civ. P. 56(a). Where the movant has met this burden, the burden shifts to the nonmovant to identify “specific facts showing that there is a genuine issue for trial.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 256 (1986) (citing Fed. R. Civ. P. 56(e)). Further, on a motion for summary judgment, all allegations and reasonable inferences must be construed “in the light most favorable” to the nonmovant. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986) (citation modified). II. Michigan law applies.
A federal court sitting in diversity applies state substantive law. 28 U.S.C. § 1652; Erie R.R. Co. v. Tompkins, 304 U.S. 64, 78 (1938). And when deciding which state’s law applies to a case, we “must apply the choice-of-law rules of the forum state.” Stone Surgical, LLC v. Stryker Corp., 858 F.3d 383, 389 (6th Cir. 2017) (citing Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941)). Here, the forum state is Michigan. Under Michigan law, contract claims are typically governed by choice-of-law provisions, Turcheck v. Amerifund Fin., Inc., 725 N.W.2d 684, 688 (Mich. Ct. App. 2006) (citation omitted), but the “presumption” for tort claims is that Michigan law governs “unless there is a ‘rational reason’ to displace [Michigan law],” Humphries v. Allstate Ins. Co., No. 18-CV-11006, 2020 WL 3248896, at *6 (E.D. Mich. June 16, 2020) (quoting Standard Fire Ins. Co. v. Ford Motor Co., 723 F.3d 690, 693 (6th Cir. 2013)).
Here, although the agreement included a Wisconsin choice-of-law provision, the district court found that Michigan law governed Coffee Capital’s negligence claim because “the injury occurred in Michigan to a Michigan company.” RE 37, Op. & Ord., PageID 207. Coffee Capital does not dispute that Michigan law applies, and RPT concedes that the outcome is the same under both Michigan and Wisconsin law. Accordingly, we apply Michigan law.
4
III. RPT does not owe Coffee Capital a separate and distinct common law duty, so Coffee Capital’s negligence claim fails as a matter of law.
A negligence claim requires four elements: duty, breach, causation, and damages. Loweke v. Ann Arbor Ceiling & Partition Co., 809 N.W.2d 553, 556 (Mich. 2011). Here, the parties focus on the duty element. Whether a duty exists “is a question of law for the court.” Saunders v. Home Depot, Inc., No. 24-1933, 2025 WL 1591875, at *1 (6th Cir. June 5, 2025) (quoting Beaudrie v. Henderson, 631 N.W.2d 308, 311 (Mich. 2001)). And where no duty exists, “summary disposition is proper.” Socia v. Pacers Basketball Corp., No. 284845, 2010 WL 446912, at *1 (Mich. Ct. App. Feb. 9, 2010) (per curiam) (citation omitted); see also Stacy v. HRB Tax Grp., Inc., 516 F. App’x 588, 589 (6th Cir. 2013) (“Whether a duty exists is for the court to decide as a matter of law.”).
Under Michigan law, to maintain a negligence claim when the parties have a contract, a plaintiff must show that the defendant owes some duty “separate and distinct” from its contractual obligations. Loweke, 809 N.W.2d at 555 (quoting Fultz v. Union-Com. Assocs., 683 N.W.2d 587, 593 (Mich. 2004)). Previously, Michigan used a misfeasance/nonfeasance test to determine legal duty, but that test is no longer the operative one. See id. at 558; see also Ram Int’l, Inc. v. ADT Sec. Servs., Inc., 555 F. App’x 493, 497 (6th Cir. 2014). A separate and distinct non-contractual duty may “arise by operation of a statute or under [the common law.]” Loweke, 809 N.W.2d at 558 (citation omitted). Common law duties flow from “a number of preexisting tort principles,” including duties imposed under “a special relationship between the parties . . . and the generally recognized common-law duty to use due care in undertakings.” Id. at 560 (citation modified). If a plaintiff fails to identify any such separate and distinct duty, the plaintiff may not sue in tort. See id. at 560-61.
5
The “separate and distinct” standard focuses on the “threshold question” of duty, id. at 561, to help ensure that plaintiffs do not “attempt to avoid [contractual] limits on liability by alleging negligence” in tort, Rinaldo’s Constr. Corp. v. Mich. Bell Tel. Co., 559 N.W.2d 647, 656-57 (Mich. 1997). However, whether a tort claim asserts a duty separate and distinct from a contract can be “difficult to discern.” Miller v. Gettel, No. 22-1034, 2023 WL 2945340, at *11 (6th Cir. Apr. 14, 2023) (quoting Loweke, 809 N.W.2d at 558). The Michigan Supreme Court has clarified that the analysis should focus not on the conduct or “contractual obligations” of a defendant, but instead on whether, in the absence of a contract, the defendant would owe “any duty at all to a particular plaintiff.” Loweke, 809 N.W.2d at 558-60 (quoting Fultz, 683 N.W.2d at 592).
To support its negligence claim, Coffee Capital asserts that RPT owed two common law duties. First, Coffee Capital argues that RPT owed a duty of due care to Coffee Capital. Second, Coffee Capital argues that it held a duty-creating special relationship with RPT. However, Coffee Capital’s arguments are unavailing.
A. RPT did not owe a common law duty of due care to Coffee Capital.
Coffee Capital first claims that RPT owed a separate and distinct common law “duty of care” to “act in a reasonably prudent manner to avoid harming Coffee Capital.” CA6 R. 19, Appellant Br., at 17. We disagree.
To determine “whether a legal duty exists,” Michigan courts consider factors such as “foreseeability of the harm, degree of certainty of injury, closeness of connection between the conduct and injury, moral blame attached to the conduct, policy of preventing future harm, and . . . the burdens and consequences of imposing a duty and the resulting liability for breach.” Brown v. Brown, 739 N.W.2d 313, 317 (Mich. 2007) (quoting Valcaniant v. Detroit Edison Co., 679 N.W.2d 689, 691 (Mich. 2004)). Importantly, criminal behavior is typically considered
6
unforeseeable, so “[t]he duty of reasonable care generally does not extend to protection from criminal acts by unknown third parties.” Ison v. Pickard, No. 207199, 2000 WL 33521095, at *4 (Mich. Ct. App. Mar. 24, 2000); see also Stacy, 516 F. App’x at 590 (“[C]riminal activity by its deviant nature is normally unforeseeable.”).
Here, RPT owes no common law duty of due care to Coffee Capital. First, as RPT notes, “the fraudster’s involvement was not foreseeable to either party.” CA6 R. 21, Appellee Br., at 21. In Brown, the Michigan Supreme Court applied this principle—that criminal harm is typically unforeseeable—to an employee’s negligence claim against her employer for assault committed by a third-party employee. 739 N.W.2d at 316-17. The plaintiff in Brown argued that the assault “was a foreseeable result of [the third-party employee’s prior] offensive speech.” Id. at 318. The court disagreed, stating that “the test of foreseeability” does not ask the court to “merely judge in hindsight whether the harm could have been avoided.” Id. at 318-19. Instead, the Brown court concluded that an employer “cannot reasonably anticipate” or foresee an employee’s criminal conduct without “notice of an imminent risk of harm to a specific victim.” Id. at 318. Similarly, in this case, because the third-party fraudster’s conduct was criminal, and because Coffee Capital does not allege that RPT had notice of any specific risk, the harm was unforeseeable as a matter of law. After all, if an employer does not, without more, have a common law duty of care to protect one employee from another employee’s criminal conduct, a commercial accountant like RPT does not have a common law duty of care to protect a commercial client’s accounts from an independent fraudster. See id. at 316-18.
Moreover, even if the harm were foreseeable, Coffee Capital fails to explain how any additional factors weigh in favor of a common law duty of due care here. While Coffee Capital is correct that a contract does not “evaporat[e] . . . any preexisting [common law or statutory duties],”
7
Coffee Capital must do more than merely assert the non-evaporation of RPT’s common law duties to properly allege the existence of a separate and distinct due-care duty. See Horrocks v. Citizens Ins. Co. of Am., No. 335972, 2018 WL 559716, at *4-7 (Mich. Ct. App. Jan. 25, 2018) (citing Loweke, 809 N.W.2d at 557-61); see also Blake v. Walmart Stores, Inc., No. 359323, 2023 WL 2618476, at *4 (Mich. Ct. App. Mar. 23, 2023), appeal denied, 997 N.W.2d 919 (2023) (“Even if [defendant’s conduct] would give rise to a duty[,] . . . a vague allegation . . . without any additional support, is not enough to survive summary disposition in this case.”). For these reasons, we find that RPT did not owe a separate and distinct duty of due care to Coffee Capital.
B. Coffee Capital and RPT did not hold a special relationship.
Coffee Capital further argues that RPT owed a separate and distinct duty to Coffee Capital because the parties had a common law special relationship. Even if Coffee Capital properly raised this claim, we decline to find a special relationship.
First, as RPT points out, Coffee Capital may have forfeited its special relationship argument by failing to adequately raise it at summary judgment below. “Parties forfeit arguments at the summary judgment stage by failing to adequately address them in response to a motion for summary judgment.” Grand v. City of Univ. Heights, 159 F.4th 507, 515, (6th Cir. 2025). Here, in its response to RPT’s motion for summary judgment, Coffee Capital alleged generally that the parties’ “relationship—accountant/client—[gave] . . . rise to certain legal duties.” RE 19, Resp., PageID 260. Apart from a single sentence noting the duties of common carriers, innkeepers, and doctors, Coffee Capital does not present a special relationship argument separate from its generic duty argument. Because Coffee Capital did not develop this argument at summary judgment, it likely forfeited it.
8
But, even if the claim were not forfeited, Coffee Capital has not shown a common law special relationship between the parties in this case. Generally, an entity “has no [common law] duty to protect another from the criminal acts of a third party in the absence of a special relationship between the [parties].” Graves v. Warner Bros., 656 N.W.2d 195, 200 (Mich. Ct. App. 2002); see also Buczkowski v. McKay, 490 N.W.2d 330, 334 (Mich. 1992). Accordingly, Michigan courts generally cabin duty-imposing special relationships to a narrow set of well-established categories, including landlord-tenant, doctor-patient, and innkeeper-guest relationships. Stacy, 516 F. App’x at 590 (citing Graves, 656 N.W.2d at 201); Marcelletti v. Bathani, 500 N.W.2d 124, 129 (Mich. Ct. App. 1993) (citation omitted).
Michigan courts use a similar, if not identical, balancing test across all common law duty determinations, including special-relationship duty inquiries. See Hill v. Sears, Roebuck & Co., 822 N.W.2d 190, 196-97 (Mich. 2012); Buczkowski, 490 N.W.2d at 334 & n.9. The core factors include the relationship of the parties, the foreseeability of the harm, the nature or severity of the risk, and the burden on the defendant. Hill, 822 N.W.2d at 196 (citation omitted); see also Stacy, 516 F. App’x at 590 (considering these factors plus “the societal interests involved”); Cooper v. City of Flint, No. 368583, 2025 WL 1420393, at *5 (Mich. Ct. App. May 14, 2025); Blake, 2023 WL 2618476, at *3 (citation omitted). The first two factors—relationship of the parties and foreseeability of the harm—are the most important. Hill, 822 N.W.2d at 196-97 (quoting In re Certified Question, 740 N.W.2d 206, 212-13 (Mich. 2007)). Indeed, “[i]f either of these two factors is lacking, then it is unnecessary to consider any of the remaining factors.” Id.; see also Dubrulle v. DTE Energy Co., No. 367095, 2025 WL 2426791, at *4 (Mich. Ct. App. Aug. 21, 2025) (per curiam) (“[A]lthough there are a variety of factors to consider when determining whether to recognize a duty, ‘the nature of the relationship between the parties and the
9
foreseeability of the harm are paramount.’” (quoting Roberts v. Salmi, 866 N.W.2d 460, 465 (Mich. Ct. App. 2014))).
Here, Coffee Capital fails to establish that its accountant-client relationship with RPT is a duty-creating special relationship.1 First, Coffee Capital cites no caselaw supporting its assertion that a commercial accountant and its commercial client, even considering the accountant’s access to the client’s financial accounts, have a special relationship. Indeed, cases involving similar facts suggest the opposite. See Banker & Brisebois Co. v. Maddox, No. 310993, 2014 WL 1720285, at *6 (Mich. Ct. App. Apr. 29, 2014) (per curiam) (“There is no Michigan caselaw holding that an accountant generally owes a fiduciary duty to his or her clients.”); Grifo & Co., PLLC v. Cloud X Partners Holdings, LLC, 485 F. Supp. 3d 885, 896-99 (E.D. Mich. 2020) (holding that a data-hosting relationship did not qualify as a common law special relationship).
Moreover, as discussed above in relation to Coffee Capital’s due-care claim, the alleged harm here—a third-party’s fraud—was likely unforeseeable. See Graves, 656 N.W.2d at 203 (“[T]he general rule [is] that criminal conduct is unforeseeable as a matter of law.”); Stacy, 516 F. App’x at 590 (same); Papadimas v. Mykonos Lounge, 439 N.W.2d 280, 283 (Mich. Ct. App. 1989) (same). In an analogous situation, the Michigan Supreme Court found that a limited contractual relationship, under which the defendant had access to the plaintiff’s house for an appliance installation, was insufficient to support a common law special relationship. Hill, 822 N.W.2d at 197-99 (citing Dyer v. Trachtman, 679 N.W.2d 311, 314-16 (Mich. 2004)). Although Coffee Capital asserts that its relationship with RPT is different from the limited relationship in Hill,
1 We do not close off the possibility that an accountant-client relationship may constitute a duty-bearing special relationship in a different context. See Grifo & Co., PLLC v. Cloud X Partners Holdings, LLC, 485 F. Supp. 3d 885, 899 (E.D. Mich. 2020); Bell v. Mich. Council 25 of Am. Fed’n of State, Cnty., & Mun. Emps., AFL-CIO, Loc. 1023, No. 246684, 2005 WL 356306, at *5 (Mich. Ct. App. Feb. 15, 2005) (per curiam).
10
Coffee Capital does not explain why “ha[ving] access to Coffee Capital’s accounts and funds” for a particular purpose, CA6 R. 19, Appellant Br., at 12-13, is different from having access to a plaintiff’s house for a particular purpose, Hill, 822 N.W.2d at 197-200 (“We decline to . . . impose a duty on [the defendant] to act for the benefit of the [plaintiff] . . . in regard to hazards created by third parties. . . . We are not aware of any caselaw holding that a [plaintiff’s] silent, unspoken assumptions impose an affirmative legal duty on another party to act in accordance with those unshared assumptions.” (citation modified)). Lastly, Coffee Capital even concedes that the parties’ “relationship existed because of the Agreement,” CA6 R. 19, Appellant Br., at 11, contravening Coffee Capital’s contention that the parties’ relationship existed separately and distinctly from the agreement.
Finally, although Coffee Capital is correct that “control” is a motivating “rationale behind imposing a duty to protect in these special relationships,” Bennett v. MIS Corp., 607 F.3d 1076, 1099 (6th Cir. 2010) (quoting Dawe v. Dr. Reuven Bar-Levav & Assocs., P.C., 780 N.W.2d 272, 275 (Mich. 2010)), Coffee Capital does not explain how RPT’s limited degree of control over Coffee Capital’s accounts created a special relationship. Here, both parties were sophisticated companies consensually engaging in a mutually beneficial commercial relationship. Coffee Capital fails to specify how this relationship created an inequitable balance of control between the parties.
CONCLUSION
In sum, RPT owes Coffee Capital neither a special relationship duty, nor a common law duty of due care. RPT and Coffee Capital voluntarily contracted for RPT to manage Coffee Capital’s funds and for RPT’s corresponding liability to be limited. Coffee Capital’s claim is based on RPT’s allegedly defective contractual performance and thus does not lie in tort. Miller, 2023
11
WL 2945340, at *11 (“[A]s Loweke clarified, an action ‘based solely on a defendant’s failure or refusal to perform a contractual promise’ lies in contract.” (quoting Loweke, 809 N.W.2d at 558)). Accordingly, the district court properly granted summary judgment to RPT.
We affirm.
12
NALBANDIAN, Circuit Judge, concurring in part and concurring in the judgment.
I agree that Michigan law doesn’t impose a duty on RPT to protect Coffee Capital based on a possible special relationship. But Coffee Capital makes another argument too—at least on appeal. It argues that RPT had a duty to not cause it harm when RPT engaged in the voluntary undertaking of wiring Coffee Capital’s money. Although I think that argument has some legs, Coffee Capital didn’t make it to the district court. So Coffee Capital forfeited it. For these reasons, I agree that we should affirm the district court’s grant of summary judgment to RPT.
I.
This is a difficult case. And add to that a lack of clarity in Coffee Capital’s arguments and, not surprisingly, you get three opinions. But one thing that’s clear is that Coffee Capital asserts a “special relationship” with RPT on appeal. And such a relationship could impose a duty on RPT to protect Coffee Capital from harm. See Buczkowski v. McKay, 490 N.W.2d 330, 334 n.9 (Mich. 1992); Williams v. Cunningham Drug Stores, Inc., 418 N.W.2d 381, 383 (Mich. 1988) (noting that “where a special relationship exists between a plaintiff and a defendant,” the general rule that “there is no duty that obligates one person to aid or protect another” falls away). So, though Coffee Capital never outright says that RPT had a duty to protect it from harm, Coffee Capital’s labeling of the special relationship, its frequent description of RPT’s duty as arising from this special relationship, and its selection of caselaw all indicate that it argues for RPT’s duty to protect.1
1 As I discuss below, this case really isn’t a duty-to-protect case—at least not a paradigmatic one. It rolled out that way because what the fraudster did here in getting paid was a crime. And criminal conduct by a third party is generally not foreseeable in Michigan unless there’s a special relationship. That’s where the duty to protect comes in. But here, Coffee Capital had entrusted RPT with its funds and asked it to provide certain services for it. Paying the fraudster was an affirmative act by RPT that also involved fraud by a third party. That’s not purely a duty-to-protect scenario.
13
The lead opinion rightly rejects this theory, but I think the question is a little closer than that opinion conveys. See Lead Op. at 8–10. In Bell, for instance, a Michigan court imposed a special-relationship duty on a union to protect its members from identity theft. Bell v. Mich. Council 25 of Am. Fed’n of State, Cnty., & Mun. Emps., AFL-CIO, Loc. 1023, No. 246684, 2005 WL 356306, at *5 (Mich. Ct. App. Feb. 15, 2005) (per curiam). The general rule that criminal conduct is unforeseeable didn’t carry the day. Id. And taking Bell’s lead, we held that Michigan law would impose the same duty on a tax-preparation company to protect its clients. Stacy v. HRB Tax Grp., Inc., 516 F. App’x 588, 591 (6th Cir. 2013).
But then there’s Grifo. There, the court declined to recognize a special relationship between two companies that had contracted for the defendant to provide cloud data-hosting services. Grifo & Co., PLLC v. Cloud X Partners Holdings, LLC, 485 F. Supp. 3d 885, 898–99 (E.D. Mich. 2020). The court rightly noted that recognizing a special relationship would “extend Michigan’s law of ‘special relationships’ to a new and expansive commercial context without the benefit of any Michigan precedent on point.” Id. at 898; see Williams, 418 N.W.2d at 382–83 (noting how the common law has hesitated to recognize special relationships beyond the traditional ones, like common carrier-passenger and landlord-tenant relationships).
Though it would depend on the standard of care if a duty were imposed on RPT, RPT’s burden to comply with its duty would probably be less than the burden imposed on the defendant in Grifo. In Grifo, a cybercriminal deployed a ransomware virus in the defendant’s internal systems to encrypt and seal off the plaintiff’s data. 485 F. Supp. 3d at 889. Here, the undisputed facts suggest that the fraud wasn’t sophisticated, or at least could’ve been easily prevented. While communicating with RPT, the fraudster impersonated a Coffee Capital principal by using a misspelled email address.
14
But the relationship between Coffee Capital and RPT is more like the relationship in Grifo than the relationships in Stacy and Bell. And we don’t have a Michigan case imposing a duty to protect for a relationship tightly analogous to the relationship here. So I can’t say that Michigan law would characterize the relationship between Coffee Capital and RPT as a special one that would impose a duty to protect.
II.
Without fully delving into the morass of Coffee Capital’s argument, Coffee Capital doesn’t just argue that RPT had a duty to protect. It also argues that “even if the conduct was part of the contract, RPT still had a duty to use due care when engaging in the prosecution of any undertaking, or to so govern its actions as to not unreasonably endanger the person or property of others.” CA6 R. 19, Appellant Br., at 18. In other words, when RPT chose to wire Coffee Capital’s funds, RPT had to exercise reasonable care to avoid causing Coffee Capital harm.
This theory shouldn’t come as a surprise. It’s well-established in Michigan that, even when the parties have contracted, the “basic rule of common law, which imposes on every person engaged in the prosecution of any undertaking an obligation to use due care,” remains. Loweke v. Ann Arbor Ceiling & Partition Co., 809 N.W.2d 553, 558 (Mich. 2011) (quoting Clark v. Dalman, 150 N.W.2d 755, 760 (Mich. 1967)); see also, e.g., Courtright v. Design Irrigation, Inc., 534 N.W.2d 181, 182 (Mich. 1995) (“While performing a contract, a party owes a separate, general duty to perform with due care so as not to injure another.”); Nelson v. Nw. Sav. & Loan Ass’n, 381 N.W.2d 757, 759 (Mich. 1985) (“[E]very contractual undertaking is accompanied by a common law duty to use ordinary care in the performance of the task undertaken.”). And whether the
15
defendant’s actions were performed within the contract or outside of it doesn’t affect the existence of this “separate and distinct” common-law duty. See Loweke, 809 N.W.2d at 560–61.
Coffee Capital says RPT’s voluntary undertaking was wiring Coffee Capital’s money to the fraudster. And to determine whether RPT had a duty to Coffee Capital when it engaged in that undertaking, Michigan again looks in part to the foreseeability of harm to the plaintiff. The lead opinion says harm caused by criminal conduct is typically seen as unforeseeable. Lead Op. at 5–6. And that’s right. But I don’t think that’s the end of it.
First of all, the idea that criminal conduct is unforeseeable in Michigan is an outgrowth of the more general tort principle that, “as a general rule, there is no duty that obligates one person to aid or protect another.” Williams, 418 N.W.2d at 383. In other words, nonfeasance usually doesn’t give rise to tort liability but misfeasance does. Id. at 382–83 (defining misfeasance as “active misconduct causing personal injury” and nonfeasance as “passive inaction or the failure to actively protect others from harm”). From that general principle flows the idea that a special relationship is usually required to impose nonfeasance liability. Hence the main argument above. But, as I explain below, this case isn’t really a nonfeasance case. RPT was contractually bound to take certain actions given its contract with Coffee Capital. That is, it was paid to use Coffee Capital’s funds to satisfy Coffee Capital’s obligations. The question is whether the common-law duty of due care in undertakings obligated RPT, while performing those contractual actions, to avoid causing the harm Coffee Capital suffered in this case.
And I think there’s a plausible argument that a company like RPT should reasonably foresee that there are schemers out there looking to defraud transacting businesses by
16
impersonating an email address.2 Considering the prevalence of cybercrime, overseas internet fraud, and impersonation scams, it seems that businesses could be expected to foresee these risks and take reasonable steps to avoid causing harm to the party whose money they control. See Graves v. Warner Bros., 656 N.W.2d 195, 201 (Mich. Ct. App. 2002) (“[O]ur courts have established a duty of reasonable care toward only those parties who are readily identifiable as being foreseeably endangered.” (citation modified)). That a party entrusted with another’s bank accounts could pay whoever asked without any internal controls and not be liable in tort—simply because the payee is a fraudster—seems very strange to me to say the least. Surely at some point a duty would be imposed. Or else the implication would be that RPT would’ve had no duty to Coffee Capital even if the fraudster had sent an email from this-is-a-scam@scam-artists.org to RPT requesting $100,000 from Coffee Capital’s account. At the very least, there’s good reason to view the “foreseeability of the harm” factor as favoring the imposition of a duty when the fraud is unsophisticated.
Coffee Capital makes a slightly different appellate argument by saying that the foreseeability of criminal conduct is irrelevant here. In its view, “[t]he inquiry is not whether the breaching party’s interaction with some third party was foreseeable, but whether the harm arising from the failure to act with due care was foreseeable.” CA6 R. 22, Reply Br., at 5 n.1. Put another way, RPT must use reasonable care any time it disburses Coffee Capital’s funds regardless of a criminal’s potential involvement because RPT is the acting party—the fraudster doesn’t wire the money, RPT does—and because disbursing funds without due care can lead to foreseeable
2 The FBI reported that in 2024, business email compromise caused nearly $2.8 billion in losses spread across 21,442 incidents, making the average roughly $130,000 per incident. Identity theft caused $174 million in losses spread across 21,403 incidents. FBI, Internet Crime Report 2024, at 9–10 (2025), https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf.
17
financial loss. See Moench v. Frankenmuth Credit Union, No. 370162, 2025 WL 1134859, at *3 (Mich. Ct. App. Apr. 16, 2025) (impliedly accepting this theory under facts analogous to this case).3 Coffee Capital’s arguments highlight the sometimes-slippery distinction between misfeasance and nonfeasance. And it’s particularly slippery here because Coffee Capital asserts theories based on misfeasance and nonfeasance alongside one another. Michigan shifted away from the distinction as the basis for determining whether a party could bring a tort action arising out of a contractual relationship. Loweke, 809 N.W.2d at 558. But the distinction is still relevant to whether there’s a separate common-law duty. The slipperiness with the distinction arises because the nonfeasance that occurs in the course of an undertaking is often the basis for the defendant’s misfeasance. Fultz v. Union-Com. Assocs., 683 N.W.2d 587, 593 (Mich. 2004). In other words, the defendant’s failure to do something, like failing to stop at a red light while driving, is often how the defendant’s misfeasance is described.
Under Coffee Capital’s theory, RPT can be liable for misfeasance because it failed to take reasonable steps—like checking if the fraudster’s email address was legitimate—in the course of its undertaking to wire Coffee Capital’s money. And RPT was handling Coffee Capital’s money, so Coffee Capital was a foreseeable victim. Whatever effect the fraudster’s actions had on RPT before it completed its undertaking shouldn’t, in Coffee Capital’s view, factor into duty.
But even if Coffee Capital is right, it forfeited the argument. RPT challenged a duty’s existence on summary judgment. And Coffee Capital’s response was all about a special
3 Though Moench offers support for Coffee Capital’s voluntary-undertaking argument, Coffee Capital cites the case for its special-relationship argument. That’s a mistake. Moench didn’t discuss the existence of a special relationship or a duty to protect. Instead, the court found that a credit union had a common-law duty to use due care when engaged in the undertaking of transferring a client’s money. Moench, 2025 WL 1134859, at *3.
18
relationship. So because Coffee Capital didn’t make its voluntary-undertaking argument to the district court, we shouldn’t resolve it on appeal. We do “not ordinarily address new arguments raised for the first time on appeal.” Mich. Bell Tel. Co. v. Strand, 305 F.3d 580, 590 (6th Cir. 2002). That’s because we aren’t “a second shot forum, a forum where secondary, back-up theories may be minted for the first time.” Id. (citation modified) (quoting Isaak v. Trumbull S & L Co., 169 F.3d 390, 396 n.3 (6th Cir. 1999).
Coffee Capital had the opportunity to raise the voluntary-undertaking argument to the district court, but it didn’t. Instead, it argued only that RPT had a duty to protect. Citing to Hill v. Sears, Roebuck & Co., 822 N.W.2d 190 (Mich. 2012), Coffee Capital told the district court that it “should question whether the relationship between the parties gives rise to any legal obligation on [RPT’s] part to act for the benefit of [Coffee Capital].” RE 19, Pl.’s Resp. to Def.’s Mot. for Summ. J., PageID 260. And it argued that it had an “accountant/client” relationship with RPT “that would give rise to certain legal duties,” equating that relationship to special relationships recognized by Michigan, like “common carriers and their passengers, innkeepers and their guests, and doctors and patients.” Id., PageID 261 (citing Hill, 822 N.W.2d at 199). When explaining RPT’s duty, Coffee Capital cited one case: Hill. There, the Michigan Supreme Court addressed whether a special relationship between the parties imposed an affirmative duty on the defendant “to act for the benefit of the” plaintiff. Id. at 196. Nowhere in its response to RPT’s summary-judgment motion did Coffee Capital say that RPT owed it a common-law duty of due care to avoid causing harm.
Even though Coffee Capital never used the term “special relationship” before the district court, changing labels on appeal doesn’t change the substance of its earlier argument. Coffee Capital wanted the district court to classify the accountant-client relationship as a special
19
relationship and impose the same duty that a special relationship would impose: an affirmative duty to protect. That’s why it equated the accountant-client relationship to special relationships recognized by Michigan. That’s why it cited the part of Hill explaining why special relationships create an affirmative duty. See Hill, 822 N.W.2d at 199 (quoting Williams, 418 N.W.2d at 383). And that’s why it argued, for instance, that RPT owed “a duty to take reasonable measures to protect and secure its emails, email accounts, and communications with its clients.” RE 19, Pl.’s Resp. to Def.’s Mot. for Summ. J., PageID 258. Establishing RPT’s duty to protect is also why Coffee Capital argued that summary judgment was premature. It told the district court that it wanted more discovery to reveal “what, if any, policies and procedures [RPT] had in place to adequately meet its duty to protect its customers[’] money, information, data, etc.” Id., PageID 257.
The new aspect of Coffee Capital’s argument on appeal is that RPT owed a duty to exercise reasonable care when wiring Coffee Capital’s money to avoid causing it harm. And because that argument is new, I see no reason to depart from our ordinary approach of disregarding it. Throughout its briefs on appeal, Coffee Capital conflates its special-relationship and voluntary- undertaking arguments without fully committing to either one4—perhaps in an attempt to evade the conclusion that any arguments were forfeited. But just how it “is not sufficient for a party to mention a possible argument in the most skeletal way, leaving the court to put flesh on its bones,” a party can’t present a morass to hide a forfeited, new argument within the one it presented to the district court. See McPherson v. Kelsey, 125 F.3d 989, 995–96 (6th Cir. 1997). Because Coffee Capital forfeited this argument, whether Michigan would accept it in a factually similar and
4 For instance, Coffee Capital argues that “this special relationship, and the duty that comes along with it, also arises under the general duty of care that arises when one undertakes an action, like wiring funds, that carries a foreseeable risk of harm.” CA6 R. 22, Reply Br., at 10.
20
properly argued case is, in my mind, a question that shouldn’t be influenced by our disposition here.
Michigan law doesn’t impose a duty on RPT to protect Coffee Capital under these facts, and Coffee Capital forfeited its other argument. So I concur in the result.
21
MATHIS, Circuit Judge, concurring in part and concurring in the judgment. I agree with the lead opinion that the district court did not err in granting summary judgment to RPT on Coffee Capital’s negligence claim. But my reasoning on the common-law-duty-of-care issue differs slightly from the lead opinion.
Under its contract with Coffee Capital, RPT was responsible for, among other things, making Coffee Capital-approved electronic payments and wire transfers to third parties. RPT breached the contract by making an unauthorized wire transfer on Coffee Capital’s behalf in response to a fraudulent request. Coffee Capital has attempted to transform that breach-of-contract claim into a negligence claim. This attempt fails as a matter of law.
Michigan law allows a party to maintain a tort action that arises out of a breach of contract under certain circumstances. The act complained of “must constitute [] a breach of duty separate and distinct from the breach of contract.” Spengler v. ADT Sec. Servs., Inc., 505 F.3d 456, 457– 58 (6th Cir. 2007) (applying Michigan law). “A separate and distinct duty” arises “under the basic rule of the common law, which imposes on every person engaged in the prosecution of any undertaking an obligation to use due care, or to so govern his actions as not to unreasonably endanger the person or property of others.” Loweke v. Ann Arbor Ceiling & Partition Co., 809 N.W.2d 553, 558 (Mich. 2011) (citation modified). “[I]f a relation exists which would give rise to a legal duty without enforcing the contract promise itself, the tort action will lie, otherwise not.” Brock v. Consol. Biomedical Lab’ys, 817 F.2d 24, 25 (6th Cir. 1987) (alteration in original) (quoting Hart v. Ludwig, 79 N.W.2d 895, 898 (Mich. 1957)).
“The question whether an action in tort may arise out of a contractual promise has not been without difficulty.” Rinaldo’s Constr. Corp. v. Mich. Bell Tel. Co., 559 N.W.2d 647, 657 (Mich.
22
1997) (citation omitted). But the “fundamental principle separating the causes of action is the concept of duty.” Id. at 658.
Coffee Capital failed to show that RPT owed it a separate and distinct duty beyond its contractual obligation to make approved payments only. That RPT may have breached the contract by making an unauthorized payment does not suffice to allow Coffee Capital to maintain a negligence action against RPT. “Because [RPT]’s sole alleged breach of duty was a breach of its contractual obligation to [make approved payments and wire transfers], [Coffee Capital]’s remedy, too, is contractual.” Ram Int’l, Inc. v. ADT Sec. Servs., Inc., 555 F. App’x 493, 498 (6th Cir. 2014) (applying Michigan law); see also Spengler, 505 F.3d at 457–58 (holding that because a security company’s “obligation to promptly and correctly dispatch EMS emanated only from the contract, not Michigan common law,” the plaintiff could not sustain a tort claim).