Oct 11, 2022 4 min read

A Uniontown jewelry store is suing PNC, accusing the bank of allowing thieves to withdraw more than $1.6 million from its account during multiple transactions over a 20-hour period in May.

Joyce’s Jewelry claims the bank did not properly secure its account when hackers gained access to one employee’s log-in information and then it failed to stop the transactions despite coming in larger amounts and more frequently than normal business withdrawals.

The store, located at 5 E. Main St. in Storey Square, said the financial losses are “risking the viability of the nearly 40-year-old family business” if they are not compensated for the theft.

“The bank’s failures here are stark and should shock and frighten small business customers who believe their accounts and accumulated savings are secure with PNC,” the lawsuit states.

The jeweler filed the lawsuit Sept. 16 in Fayette County Court of Common Pleas, but it was transferred to federal court in Pittsburgh last week since PNC is based in Delaware.

The lawsuit claims hackers somehow obtained information from one employee May 12 and were able to transfer the store’s funds spread across four separate PNC accounts into a single account. From there, the hackers then made 12 wire transfers over 20 hours to move the money into the criminals’ two accounts with other banks. The lawsuit states that PNC’s online security features should have required two employees to authorize the transfers, which would have stopped the money from being withdrawn.

The wire amounts ranged from $70,000 to nearly $200,000 and were vastly larger than what Joyce’s would typically move in single transactions. In addition, the theft depleted the store’s account and even resulted in a $200,000 overdraft, prompting additional fees.

The business claims that PNC failed to stop the transactions despite the “exceedingly unusual activity” with its accounts, and only took action after Joyce’s notified the bank of the issues. The lawsuit claims a banker at a PNC branch in Uniontown “broke down in tears due to her inability to mitigate the ongoing depletion” of Joyce’s account.

“Even after being notified, PNC failed to so much as freeze Joyce’s accounts during the ongoing fraud,” the lawsuit states.

In addition, the business claims that it had just moved to PNC’s new online corporate banking platform called PINACLE late last year that was supposed to be more secure and prevent such thefts from happening. The selling point of the platform was a multi-factor authentication and dual-control authorization for wire transfers. The lawsuit claims an employee clicked on a “spoofed” website made to look like PNC’s homepage and entered her log-in information, but the second user’s “token” information was never requested when transactions began almost immediately.

After futile attempts to solve the problem with the local PNC Bank branch, workers called Uniontown police and were eventually put in touch with the FBI. Over the next few weeks, the business attempted to uncover information about how the theft occurred while trying to recoup its losses. The two banks that held the accounts used by the thieves reimbursed Joyce’s Jewelry $225,000 and $300,000 respectively, although PNC withdrew $192,337 from that total to pay for overdraft fees, interest and a corporate analysis of the situation, according to the lawsuit.

The store estimates it lost a total of $1.1 million from the theft. It also dealt with issues while trying to still run the business facing liquidity problems and frozen assets through the process.

“This action arises out of PNC’s failure to keep its customers’ hard-earned money safe,” the lawsuit states.

Carl A. Frankovitch, the West Virginia-based attorney representing Joyce’s Jewelry, said they are hoping PNC will take responsibility for the breach and make the business whole.

A PNC spokesperson could not be reached for comment Monday.