You are (or should be) if you took no effort to avoid the fraud for something this important. In IT, if you hire a company to handle your SSO, but don’t check that they have the required certifications verified by independent auditors for their own security you may well be on the hook when they expose your customers’ data.