If your friend scams someone in a M2M transaction, you are held accountable on the basis of surety bonds.

It's been in RG guidelines since 2007, i can't believe you don't know this rule.