Uniontown, Pa. – The owners of Joyce’s Jewelry in the Pittsburgh-area town of Uniontown are suing PNC Bank after cybercriminals drained its accounts of nearly $1.6 million in a series of wire transfers.
The retailer filed the lawsuit in October, accusing PNC Bank of failing to keep its money safe. The Pittsburgh Post-Gazette reported on the lawsuit in a story published on Monday.
The theft took place on the afternoon of 12 May 2022.
According to court documents filed in U.S. District Court in Pittsburgh, a jewellery store employee accidentally logged on to a fake website designed to look like PNC Bank’s.
She noticed that the site wasn’t loading properly and called the customer service number she found on the fake site. She was told to be patient because the site was slow that day, something she said PNC had told her before, according to court documents.
Soon after, the store’s Internet service went down. Then the employee and Joyce’s Jewelry CEO Brandon Katzeff experienced a “subscription attack,” meaning they started receiving hundreds of emails every hour, making it difficult to tell which were real.
That night, PNC sent Katzeff an email alerting him to “two small but suspicious charges” on one of the store’s credit cards. He called PNC’s fraud prevention service line and cancelled the credit card.
In the lawsuit, Joyce’s alleges that no mention was made of any other suspicious activity or the multiple transfers made that day.
The next morning, after IT services restored the store’s Internet service, Katzeff realised the company’s accounts had been hacked and contacted PNC Bank.Using the employee’s credentials obtained from the phishing site, the cybercriminals emptied all four of the store’s accounts through 11 wire transfers over a 20-hour period.
In total, approximately $1.6 million was transferred from the jeweller’s PNC accounts to the hackers’ accounts at JPMorgan Chase and Bank of America.
Later that day, a PNC cyber fraud analyst emailed Katzeff about an attempted transfer of more than $105,000. It was the last of nearly a dozen unauthorised transfers and the only one flagged by the bank, the lawsuit alleges.
The analyst told Joyce’s that the bank was not responsible for the losses and advised Katzeff to contact law enforcement and the recipient banks.
PNC Bank has filed a motion to dismiss the lawsuit and said through a spokesman that it believes it took the right steps regarding the transactions.
“While PNC regrets any losses incurred by a customer, we disagree with the allegations in this case and believe we acted appropriately with respect to the transactions,” a PNC Bank spokesperson said in a statement to National Jeweler.
Joyce’s Jewellery disagrees.
The transfers should have raised a red flag for PNC, the jeweller said in its lawsuit, noting that the money was being sent to accounts and companies it had never sent money to before.
The wire amounts were also tens of thousands of dollars per wire, well above the usual transaction amounts. Joyce’s had never wired nearly a million dollars in a single day.
The transfers also exceeded available funds, resulting in an overdraft charge of nearly $200,000 for a customer who, to Joyce’s knowledge, had never been overdrawn.
“The bank’s failures here are stark and should shock and frighten small business customers who believe their accounts and accumulated savings are safe with PNC,” the court documents state.
“PNC’s failures allowed substantially all of the liquidity that Joyce’s had managed to accumulate over decades to be stolen in less than 24 hours.”
The bank also failed to provide the jeweller with information on how to recoup its losses, Joyce’s said, and allegedly kept the owners in the dark about what was being done to recover the money.
The jeweller has also been referred to a third-party collection agency to recover overdraft fees and may be charged “corporate analysis fees” while PNC investigates the theft.
The family-owned business was founded by Joyce Katzeff in the early 1970s. It began as a small store in Uniontown, Pennsylvania, and later expanded to a 7,000-square-foot location.
The company has banked with PNC and banks acquired by PNC since its inception and has implemented recommended security features in its Pinacle” online and mobile banking platform.
The wire transfer procedures and security protocol for Joyce’s require multi-factor and dual control authorisation to send wires, the jeweller said in the lawsuit, but the thieves accessed their accounts using only an employee’s login information.
The lawsuit notes that some of the money has been recovered, including an expected, unspecified “partial” recovery from Bank of America and more than $224,000 from JPMorgan.
However, PNC withdrew about $192,000 to pay itself for the overdraft, interest and fees.
As of October 2022, Joyce’s losses amount to approximately $1.1 million.
In addition to the financial losses, Joyce’s said it struggled to operate its jewellery store with minimal cash and frozen accounts.
Its employees and vendors have also been unable to cash or deposit their paychecks and payments.
The retailer had to change its purchasing practices, the lawsuit said, causing it to lose out on discounts from trade show purchases.
And Joyce’s management has had to shift its focus from the business to its financial problems.
The jeweller is asking the court to order PNC Bank to return all the stolen money and overdraft fees, as well as to award it damages.
