How a Jeweler Lost $1.6M in Less than 24 Hours

Uniontown, Pa.—The owners of Joyce’s Jewelry in the Pittsburgh-area city of Uniontown are suing PNC Bank after cybercriminals emptied its accounts of nearly $1.6 million through a series of wire transfers.

The retailer filed the lawsuit in October accusing PNC Bank of failing to keep its money safe. The Pittsburgh Post-Gazette covered the suit in a story published Monday.

The theft took place on the afternoon of May 12, 2022. 

According to court documents filed in U.S. District Court in Pittsburgh, a jewelry store employee accidentally logged into a phony website made to look like PNC Bank’s website.

She noticed the website wasn’t loading properly and called the customer service number she found on the spoofed webpage. She was advised to be patient as the website was slow that day, something she said PNC had told her before, court documents state.

Soon after, the store’s internet service went down. Then the employee and Joyce’s Jewelry CEO Brandon Katzeff experienced a “subscription attack,” meaning they started receiving hundreds of emails every hour making it difficult to tell which are genuine.

That night, PNC sent Katzeff an email, alerting him to “two small but suspicious charges” on one of the store’s credit cards. He called PNC’s fraud prevention service line and canceled the credit card.

In the lawsuit, Joyce’s claims no mention was made of any other suspicious activity or the multiple wire transfers made that day.

The next morning, after IT services restored the store’s internet service, Katzeff realized the company accounts had been hacked and he reached out to PNC Bank.

Using the employee’s login credentials obtained from the phishing website, cybercriminals had emptied all four of the store’s accounts through 11 wire transfers over a period of 20 hours.

In total, around $1.6 million was transferred from the jeweler’s PNC accounts to the hackers’ accounts at JPMorgan Chase and Bank of America.

Later that day, a PNC cyber fraud analyst emailed Katzeff about an attempted wire transfer of more than $105,000. It was the last of nearly a dozen unauthorized wire transfers and the only one flagged by the bank, the lawsuit claims.

The analyst told Joyce’s the bank held no responsibility for the losses and advised Katzeff to contact law enforcement and the beneficiary banks.

PNC Bank has filed a motion to dismiss the lawsuit and, through a spokesperson, said it believes it took the right steps in regard to the transactions. 

“While PNC regrets any losses incurred by a customer, we disagree with the allegations in this case and believe we acted appropriately with respect to the transactions,” a PNC Bank spokesperson said in a statement to National Jeweler.

Joyce’s Jewelry disagrees.

The transfers should have raised a red flag for PNC, the jeweler said in its lawsuit, noting the money was moved to accounts and businesses it had never sent money to before. 

The wire amounts were also far above the usual transaction amounts by tens of thousands of dollars per wire. Joyce’s had never wired close to a million dollars in one day.

The wires also exceeded the funds available, leading to an overdraft charge of nearly $200,000 for a customer that, to the best of Joyce’s knowledge, had not overdrawn on an account before. 

“The bank’s failures here are stark and should shock and frighten small business customers who believe their accounts and accumulated savings are secure with PNC,” court documents state.

“PNC’s failures allowed substantially all the liquidity that Joyce’s had managed to accumulate over decades to be stolen in less than 24 hours.” 

The bank has also not provided the jeweler with information about how to recoup its losses, said Joyce’s, and allegedly kept the owners in the dark about what was being done to recover the money.

The jeweler was also directed to a third-party collection agency to demand repayment of the overdraft fees and could be billed for “corporate analysis charges” as PNC looks into the theft.

The family-owned business was founded by Joyce Katzeff in the early 1970s. It began as a small store in Uniontown, Pennsylvania, later expanding to a 7,000-square-foot location.

The company has banked with PNC and banks acquired by PNC since its founding and implemented the recommended security features on its “Pinacle” online and mobile banking platform.

The wire procedures and security protocol for Joyce’s requires multi-factor and dual-control authorization to send wires, the jeweler said in the suit, but the thieves got into their accounts using just one employee’s login information.

The suit notes that some of the money has been recovered, including an anticipated, unspecified “partial” recovery from Bank of America and more than $224,000 from JPMorgan.

However, PNC withdrew around $192,000 to pay itself for the overdraft, interest, and fees.

Joyce’s losses stand at around $1.1 million as of October 2022.

In addition to the financial loss, Joyce’s said it has struggled to run its jewelry store with minimal cash and frozen accounts.

Its employees and vendors were also unable to cash or deposit their paychecks and payments.

The retailer has had to change its purchasing practices, the suit states, causing it to lose out on discounts from trade show purchases.

And Joyce’s senior management has had to shift focus from the business to its financial issues.

The jeweler is asking the court to order PNC Bank to refund all of its stolen money and overdraft fees as well as award it damages.