**132Agnes Christine Terry, Administrator of the Estate of Peter Ambrister, appeals from the circuit court's judgment dismissing her wrongful death action against Irish Fleet, Inc., d/b/a Boulevard Cab ("Irish Fleet") and Reginald Morris arising from the murder of her husband, a taxicab driver, by his passenger. Terry argues that the circuit court erred in ruling that her amended complaint failed to **133state a claim for which relief could be granted against Irish Fleet and Morris under a theory of assumed duty. Finding no reversible error in the circuit court's ruling, we will affirm its judgment.
I.
Because this case was decided below on demurrer, we accept as true the well-pleaded facts set forth in the amended complaint and all inferences fairly drawn therefrom. Tharpe v. Saunders , 285 Va. 476, 478, 737 S.E.2d 890, 891 (2013). We are not bound, however, by the "conclusory allegations" set forth in the amended complaint. Brown v. Jacobs , 289 Va. 209, 212 n.2, 768 S.E.2d 421, 423 n.2 (2015) (citation omitted).
A.
At the time of Ambrister's death, he was a taxicab driver employed by "Craig Buck and/or Cab King, Inc., and/or John Doe Corporation." Defendant Irish Fleet "owned and operated several cabs for hire in the City of Petersburg and provided dispatch services for other cabs in the City of Petersburg." Defendant Morris was employed by Irish Fleet "to administer dispatch services."
On October 17, between 8:34 and 10:04 p.m., Morris, in the scope of his employment with Irish Fleet, received a series of eight "troubling" telephone calls from a male caller. During one of these calls, the caller asked for a taxicab "from Jesse Lee Apartments, building 700, going to Halcom Manor." Morris "thought this call was a 'red flag' " because the caller "indicated [he was] calling from a payphone, but [Morris] knew that there was not a payphone at that location."
*791When the caller telephoned again, Morris "established a call back number" and "documented" it as "one that merited screening." After several calls, Morris dispatched a taxicab, but then cancelled it after "the caller called back and requested a change in pick-up location to a business that [Morris] knew to be closed, all of the business around it closed, and was in front of the apartment complex." Morris also "called another cab company to warn them about this caller."
On the morning of October 18, Ambrister reported to work "for Craig Buck and/or Cab King, Inc. and/or John Doe Corporation." At approximately 9:15 a.m., Tanya Tatum,2 another dispatcher employed with Irish Fleet, received a phone call "from the Caller **134on the same phone as the night before requesting a cab from Jesse Lee Apartments, building 700, going to Halcom Manor." Tatum dispatched Ambrister to this caller, and sometime after Ambrister began the transport, he was fatally shot three times by his passenger.
B.
Terry filed an amended complaint against Irish Fleet and Morris, and other defendants, asserting that the defendants "were negligent and their negligence was the proximate cause of [Ambrister's] death."
With regard to Irish Fleet and Morris, Terry asserts a theory of assumed duty. Specifically, Terry alleges that defendants
undertook, gratuitously or for consideration, to render services, including but not limited to[,] screening calls of potential cab fares callers, pick up locations, drop off locations[,] including the Caller as described in this complaint, and determining the safety risk of the call, caller, and/or location for the health and safety of cab drivers they dispatch, using ordinary car[e] in the screening and selection process of whom they accept fares from and when, or if, they dispatch a cab to the potential callers and location, and the warning of known dangerous or troubling callers or fares to Irish Fleet and all other employees and/or agents of Irish Fleet which Irish Fleet, Tatum, Morris, and/or John Doe should recognize as necessary for the protection of people and other cab drivers, including [Ambrister].
Terry alleges that Tatum "negligently dispatched [Ambrister] to a known dangerous fare that led to his death despite the documentation in the log book of the troubling calls" from the prior evening. Terry alleges, in the alternative, that Morris "negligent[ly] failed to warn and document the safety concern this caller with identifiable call back number posed to the cab drivers['] health and safety, which increased the risk of harm to [Ambrister]." Terry contends that Irish Fleet is "vicariously liable for the acts and omissions of their employees ... including Tatum and Morris," and that all defendants knew or should have known of prior crimes committed **135against cab drivers in Petersburg earlier in the year that Ambrister was murdered and in the preceding 25-year period.
Irish Fleet and Morris filed demurrers to Terry's amended complaint and asserted, among other grounds, that the amended complaint failed to allege sufficient facts to support a cause of action based on a theory that they assumed a duty to Ambrister. The circuit court sustained the demurrers and Terry nonsuited her claims against the remaining defendants.
II.
In reviewing the circuit court's judgment sustaining the defendants' demurrers, we note that "[t]he purpose of a demurrer is to determine whether a complaint states a cause of action upon which the requested relief may be granted." Murayama 1997 Trust v. NISC Holdings, LLC, 284 Va. 234, 245, 727 S.E.2d 80, 86 (2012) ; see Code § 8.01-273. A demurrer tests the legal sufficiency of the facts properly alleged, and the inferences fairly drawn therefrom, but does not admit the correctness of the complaint's *792legal conclusions. Murayama 1997 Trust , 284 Va. at 245, 727 S.E.2d at 86.
A.
"To plead a cause of action for negligence, a plaintiff must allege a legal duty, a violation of that duty and resulting damage." Brown , 289 Va. at 215, 768 S.E.2d at 424 (citation omitted). Because Ambrister's fatal injury was inflicted by his passenger, Irish Fleet and Morris are only subject to liability if they owed a duty to Ambrister to warn or protect him against the danger of criminal assault by his passenger.
As a general rule, there is no duty to warn or protect against acts of criminal assault by third parties. This is so because under "ordinary circumstances, acts of assaultive criminal behavior by third persons cannot reasonably be foreseen." A.H. v. Rockingham Publ'g Co. , 255 Va. 216, 222, 495 S.E.2d 482, 486 (1998). Indeed, "[i]n only rare circumstances has this Court determined that the duty to protect against harm from third party criminal acts exists." Commonwealth v. Peterson , 286 Va. 349, 359, 749 S.E.2d 307, 312 (2013).
**136We have previously held that "[b]efore any duty can arise with regard to the conduct of third persons, there must be a special relationship between the defendant and either the plaintiff or the third person." A.H. , 255 Va. at 220, 495 S.E.2d at 485. "Examples of such a relationship between a defendant and a plaintiff include common carrier-passenger, business proprietor-invitee, and innkeeper-guest." Id. "Another example of a special relationship is that of employer-employee with regard to the employer's potential duty of protecting or warning an employee." Id. We have repeatedly stated that the finding of a special relationship is a "threshold requirement." Brown , 289 Va. at 215, 768 S.E.2d at 425 (quoting Peterson , 286 Va. at 357, 749 S.E.2d at 311 ); Taboada v. Daly Seven, Inc. , 271 Va. 313, 323, 626 S.E.2d 428, 433 (2006).3 With regard to the criminal act of murder specifically, we have noted that a defendant "cannot be deemed to have anticipated nor be expected to guard and protect [a plaintiff] against a crime so horrid, and happily so rare, as that of murder." Connell's Ex'rs v. Chesapeake & Ohio Ry. , 93 Va. 44, 58, 24 S.E. 467, 469 (1896).
In the absence of satisfying the "threshold requirement" of a special relationship, we have recognized that a defendant may owe a duty to protect against an act of criminal assault by a third party where the defendant voluntarily undertook such duty by expressly communicating his intention to do so. See Burns v. Gagnon , 283 Va. 657, 727 S.E.2d 634 (2012). This duty is based on the general common law principle that "one who assumes to act, even though gratuitously, may thereby become subject to the duty of acting carefully, if he acts at all." Id. at 672, 727 S.E.2d at 643 (citation omitted).4
**137In Burns , the plaintiff was a high school student who claimed that a friend of his told *793the assistant principal that plaintiff "was going to get into a fight with another student sometime that day." Id. at 664, 727 S.E.2d at 639. According to the plaintiff, the assistant principal "wrote down [plaintiff's] name and told [plaintiff's friend] that he would 'alert [his] security and we'll make sure this problem gets taken care of.' " Id. We held that the assistant principal was subject to liability for breach of a voluntarily assumed duty based on his express promise to take care of the impending fight. Id. at 672-73, 727 S.E.2d at 644.5
On the other hand, we have rejected the contention that a defendant "voluntarily assumed" a legal duty to protect or warn against acts of criminal assault by a third person "merely because [a defendant] took precautions not required of it" to protect the safety of the plaintiff. A.H. , 255 Va. at 223, 495 S.E.2d at 487. In A.H. , we held that a newspaper publishing company did not have a duty to warn a 13-year old newspaper carrier of the danger of criminal assault by a third party, despite the existence of a special relationship between the carrier and the publishing company and the voluntary efforts undertaken by the company to advise its carriers about safety precautions while on their routes. Plaintiff's special relationship with the company did not give rise to a duty to warn or protect him against the criminal assault because "it was **138[not] shown that the prior assaults were at or near the location of the plaintiff's assault, or that they occurred frequently or sufficiently close in time to make it reasonably foreseeable that the plaintiff would be similarly assaulted." Id. at 222, 495 S.E.2d at 486.
We also rejected plaintiff's claim that the company "voluntarily assumed a legal duty" to warn the plaintiff of the possibility of similar attacks "in advising carriers about safety precautions while on their routes and in equipping them with whistles." Id. at 223, 495 S.E.2d at 487. As we explained, "[a]ssuming, but not deciding, that Rockingham's safety literature, video, and safety whistles were inadequate, we concluded that, whatever Rockingham may have voluntarily done in providing this material, Rockingham's actions did not give rise to a duty to give a more complete warning." Id. We further noted that "creation of a duty under these circumstances would discourage other parties from taking extra precautions to avoid being subjected to a liability which they otherwise would not have had." Id.
As a general proposition, a duty that does not otherwise exist may be impliedly assumed from the defendant's conduct. See 2 Dan B. Dobbs et al., The Law of Torts § 410, at 671 (2011) (recognizing that an implied undertaking may give rise to an assumed duty). For example, we have recognized that an assumed duty may be undertaken gratuitously by a motorist to another motorist or a pedestrian when he signals to the other motorist or pedestrian that it is safe to proceed. See Ring v. Poelman , 240 Va. 323, 327, 397 S.E.2d 824, 826 (1990) (noting that an assumed *794duty could arise based on evidence that motorist signaled to another motorist that it was safe to proceed, but holding no evidence of proximate cause); Cofield v. Nuckles , 239 Va. 186, 192-93, 387 S.E.2d 493, 496-97 (1990) (noting that an assumed duty could arise based on evidence that the motorist signaled to a pedestrian that it was safe to proceed, but holding no evidence of breach of duty); Nolde Bros. v. Wray , 221 Va. 25, 28-29, 266 S.E.2d 882, 884 (1980) (acknowledging common law principle of assumed duty but holding that law would not recognize any such duty where motorist's gestures could not be interpreted as a signal that it was safe to proceed). We have not, however, recognized that an implied **139undertaking may give rise to an assumed duty to warn or protect against the danger of a criminal act by a third party. See A.H. , 255 Va. at 223, 495 S.E.2d at 487.
B.
Applying these principles, we must determine whether Terry alleged sufficient facts to plead a viable cause of action in tort against defendants based on the theory that they owed a duty to warn or protect Ambrister from the danger of criminal assault by his passenger. "The issue whether a legal duty in tort exists is a pure question of law." Kellermann v. McDonough, 278 Va. 478, 487, 684 S.E.2d 786, 790 (2009).6
Terry does not assert that these defendants owed a duty to Ambrister arising from a special relationship with either Ambrister or the caller. Terry does not assert that these defendants agreed or promised to warn or protect taxicab drivers using Irish Fleet's dispatch services against the danger of criminal assault by passengers. Terry also does not assert that these defendants expressly communicated an intent to warn or protect taxicab drivers using Irish Fleet's dispatch services against the danger of criminal assault by passengers. Thus, Terry does not assert facts to support either one of the two theories on which we have recognized a duty to warn or protect against criminal assault by a third party-a duty arising from the existence of a special relationship and a duty voluntarily assumed by an express undertaking.
**140Instead, Terry's claim that defendants assumed a duty to protect Ambrister is based on an implied voluntary undertaking. Terry alleges that the dispatchers assumed a duty to warn or protect the taxicab drivers using Irish Fleet's dispatch services against the danger of criminal assaults by passengers when they "undertook," in the scope of their employment with Irish Fleet, to "screen[ ] calls of potential cab fares," to determine the perceived "safety risk" of the calls in the "selection process of whom they accept fares from," and to document "known or troubling" callers in a log book for use of other dispatchers.
We have previously refused to recognize a voluntarily assumed duty to warn or protect against the danger of criminal assault by a third person "merely because [a defendant] took precautions not required of it" to protect the safety of the plaintiff. A.H. , 255 Va. at 220, 495 S.E.2d at 485. As we noted in A.H. , "creation of a duty under these circumstances would discourage other parties from taking extra precautions to avoid being subjected to a liability which they otherwise would not have had." Id.
The consequence of imposing an assumed duty to warn or protect against criminal assault based merely on voluntary conduct, such as that alleged in the amended complaint, rather than an express communication, is that there is no specifically described undertaking. The alleged undertaking is necessarily ambiguous and there is no designated beginning or end to the undertaking. As applied here, an impliedly assumed duty would be owed by an indefinite number of individuals (all Irish Fleet dispatchers who screen and flag calls) to an indefinite number of individuals (all taxicab drivers who use Irish Fleet's dispatch services) and would presumably extend to all dispatching businesses and individual employees that engage in a similar screening and documentation practice-a practice that is undoubtedly common to the dispatching business in general.
The existence of a duty to protect against criminal acts of third parties is the exception, and as we have stated, arises only **141in "rare circumstances," Peterson , 286 Va. at 359, 749 S.E.2d at 312. If we were to recognize that a duty to warn or protect against the danger of criminal assault by third persons could arise outside the context of a special relationship or an express undertaking, the exception would swallow the rule. Therefore, we believe the recognition of a voluntarily assumed duty to warn or protect against the danger of criminal assault by a third person should be confined to express undertakings. Because Terry's claim that Irish Fleet and Morris voluntarily assumed a duty to warn or protect Ambrister against the danger of criminal assault is based on an implied undertaking, the allegations of her amended complaint are insufficient to state a claim against these defendants.
III.
For the foregoing reasons, we hold that the circuit court did not err in in ruling that Terry's amended complaint failed to state a claim for which relief could be granted against Irish Fleet and Morris under a theory of assumed duty. Accordingly, we will affirm the judgment of the circuit court.
Affirmed .
JUSTICE McCULLOUGH, with whom JUSTICE MIMS and JUSTICE POWELL join, dissenting.
The majority has fashioned a rule, unique to Virginia, under which an assumption of a duty to warn of or protect against a crime must be an express undertaking, i.e. no such duty can be assumed by conduct. This standard finds no support in our caselaw, in the Second Restatement of Torts, in persuasive authority from other states, or in academic commentary. It is inconsistent with the concept of an assumed duty as that concept comes to us from the common law. The effect of this unique rule is to remove any accountability for those who have, by their conduct, assumed a duty to warn or protect against the criminal acts of others and negligently performed this duty. The majority thereby leaves persons who have detrimentally relied on such conduct without recourse.
The majority acknowledges, as it must, the proposition that a duty can be assumed implicitly, *796that is, by conduct, as well as by an **142express undertaking. See Restatement (Second) of Torts § 323 (1965). Indeed, we have said as much. "It is ancient learning that one who assumes to act, even though gratuitously, may thereby become subject to the duty of acting carefully, if he acts at all."See, e.g. , Nolde Bros. v. Wray , 221 Va. 25, 28, 266 S.E.2d 882, 884 (1980) (quoting Glanzer v. Shepard , 233 N.Y. 236, 135 N.E. 275, 276 (1922) ); see also 2 Dan B. Dobbs et al., The Law of Torts § 410, at 670 (2011) (Assumption of duty "is a kind of explicit or implicit promise, or at least a commitment, conveyed in words or conduct.").
My extensive reading of cases (of which there are many) from sister states, treatises, and law review articles yields no support for the proposition a duty to warn or protect of a crime, uniquely among all assumed duties, can be assumed only by an express promise.
In other contexts, we have recognized that a duty that would not otherwise exist can be assumed by conduct. See, e.g. , Nolde Bros. v. Wray , 221 Va. 25, 266 S.E.2d 882 (1980) (driver who negligently gives a hand signal can be held liable for assuming a duty); Fruiterman v. Granata , 276 Va. 629, 645, 668 S.E.2d 127, 136 (2008) (physician can by affirmative acts assume a duty of care to a non-patient). It is not clear as a conceptual matter why a motorist or a physician can be held liable in tort for assuming a duty by conduct, but a person assuming a duty by conduct to warn or protect others of a crime cannot.
As support for its holding, the majority notes that "the duty to protect against criminal acts of third parties is the exception and ... arises only in 'rare circumstances.' " True enough, but the very point of assumption of duty liability is to hold accountable one who assumed a duty (through words or conduct) that did not exist in the first place, and who then performed the undertaking negligently.
The majority's chief concern appears to be the factual indeterminacy of pinpointing when someone actually has undertaken a duty, and to whom that duty is owed. Surely, this Court can fashion a carefully crafted and properly limited standard and judges and juries can faithfully apply such a standard.1 As things stand, to **143paraphrase G.K. Chesterton, a standard has not "been tried and found wanting. It has been found difficult; and left untried."2
Rather than abjure the concept of a duty that can be assumed by action, I would recognize liability for a person who assumes a duty to warn or protect others of crime by conduct, subject to the following limitations:
1. Purposeful conduct is required. If the duty is assumed by conduct, it "requires affirmative, deliberate conduct such that it is 'apparent that the actor ... specifically [undertook] to perform the task that he is charged with having performed negligently.' " Yost v. Wabash College , 3 N.E.3d 509, 517 (Ind. 2014) (alterations in original).
2. An isolated act does not qualify. An isolated act generally should not give rise to an assumed duty in perpetuity. See *797Fort Bend Cty. Drainage Dist. v. Sbrusch , 818 S.W.2d 392, 397 (Tex. 1991) ("A person's duty to exercise reasonable care in performing a voluntarily assumed undertaking ... will not normally give rise to an obligation to perform additional acts of assistance in the future."); City of Santee v. Cty. of San Diego , 211 Cal.App.3d 1006, 259 Cal.Rptr. 757, 763-64 (1989) (County Sheriff's past reporting of street light outages did not create an ongoing duty to do so in the future because, otherwise, "an act of humanitarian assistance can become an albatross of mandatory obligation in the future.").
3. The assumed duty must be toward a specific person or an identifiable and limited class . Reasonable bounds to the concept of assumed duty require that liability should be limited to duties assumed toward a specific person or a limited and identifiable class.
**144See, e.g. , Pacific Indem. Co. v. Whaley , 560 F.Supp.2d 425, 430 n.4 (D. Md. 2008) (settled law that a person can undertake a duty to a class of persons); Krieger v. J.E. Greiner Co. , 282 Md. 50, 382 A.2d 1069, 1081 (1978) (Levine, J. concurring) ("It is settled tort law that once a person gratuitously embarks upon a course of conduct intended to protect another person or class of persons whom he was under no preexisting legal duty to protect," he is bound by that duty.); Schwarz v. Philip Morris Inc. , 206 Or.App. 20, 135 P.3d 409, 423 (2006) ("Unlike in a negligence claim where a defendant may assume a duty to more than one person or to a class of persons, the intrinsic nature of a claim of promissory fraud" protects only the person to whom the promise is made.); November v. Chesterfield Cnty. , 2017 WL 4922017, at *6, 2017 U.S. Dist. LEXIS 180631, at *15-16 (E.D. Va. Oct. 31, 2017) (rejecting plaintiff's assumption of duty theory because it would impose a duty on the defendant to "protect virtually the entire population of the planet," and "[n]o Virginia case imposes a duty to such an enormous and amorphous class").
4. Liability is limited by the extent of the undertaking. Liability for an assumed duty should not extend beyond the scope of the actual undertaking. See Davis v. Westwood Group , 420 Mass. 739, 652 N.E.2d 567, 571-72 (1995) (defendant voluntarily assumed a duty to hire police officers to direct pedestrians across a road between the parking lot and the race track; it did not undertake "a much broader duty" of providing safe passage across the road, such as erecting a traffic light or building a pedestrian bridge); see also Walls v. Oxford Mgmt. Co. , 137 N.H. 653, 633 A.2d 103, 106-07 (1993) (observing that a voluntary assumption of duty "is limited by the extent of the undertaking" and noting that based on that principle, "a landlord who provides lighting for the exterior of an apartment building might be held liable for failing to insure that the lighting functioned properly, but not for failing to provide additional security measures such as patrol services or protective fencing" (citation omitted) ); Feld v. Merriam , 506 Pa. 383, 485 A.2d 742, 746-47 (1984) (holding that the provision of one security guard subjects the landlord to a duty of care equal to the amount of protection one guard could reasonably be expected to provide).
5. The plaintiff must have detrimentally relied on the assumed duty . "[T]raditionally, the purpose of imposing liability upon a party who has assumed a duty to act is premised upon reliance."
**145Ostendorf v. Clark Equip. Co. , 122 S.W.3d 530, 538 (Ky. 2003) ; see also Restatement (Second) of Torts §§ 323, 324A (1965). Consequently, a plaintiff must show he detrimentally relied on the assumed duty.
In my view, the allegations made in the complaint, and the inferences from those allegations, were sufficient, if proved, to establish an assumption of duty and, therefore, to survive demurrer. The complaint alleges that the defendants assumed a duty, and it provides a concrete example showing that the dispatchers working for Irish Fleet provided a warning to another cab driver of criminal danger. In addition, the allegations are sufficient to show that, had a warning been provided, Ambrister would have relied on the warning. I would reverse the judgment and remand the case for further proceedings.
For all of these reasons, I respectfully dissent.