Judge Rules Jeweler’s Lawsuit Against PNC Bank Can Move Forward

Uniontown, Pa.—A preliminary ruling by a Pennsylvania judge will allow a jeweler who lost more than $1 million in a cyberattack to move forward with its lawsuit against PNC Bank and some of its employees.

The owners of Joyce’s Jewelry in the Pittsburgh-area city of Uniontown sued PNC in September 2022 after cybercriminals stole nearly $1.6 million from the retailer’s bank accounts through a series of wire transfers. 

The theft took place on the afternoon of May 12, 2022, when one of the jewelry store’s employees accidentally logged into a phony website made to look like PNC Bank’s website.

Using the employee’s login credentials obtained from the phishing website, cybercriminals emptied all four of the store’s bank accounts through 11 wire transfers sent over a period of 20 hours.

In the lawsuit, the store’s owners alleged that PNC Bank failed to keep its money safe, while PNC claimed it took the proper steps in regard to the transactions and the fault lies with Joyce’s Jewelry and its employee.

The jeweler claimed these transfers should have raised a red flag for PNC because the money was moved to accounts and businesses it had never sent money to before. 

The wire amounts also were far above the usual transaction amounts, by tens of thousands of dollars per wire. Joyce’s had never wired close to $1 million in a single day.

The wires also exceeded the funds available, leading to an overdraft charge of nearly $200,000, another abnormality that should have caught the bank’s attention. Joyce’s, to its knowledge, had never overdrawn on its accounts before, the lawsuit states. 

PNC did recover some of the stolen funds, and charged the jeweler for its recovery efforts, bringing the loss total down to $1.1 million.

The case brought by Joyce’s Jewelry initially went to the Court of Common Pleas of Fayette County, Pennsylvania, which is a state court.

PNC Bank asked that a federal court, the U.S. District Court for the Western District of Pennsylvania, take up the matter.

On Jan. 12, 2023, the federal court denied that request, ruling the state court should continue to handle the case.

Two weeks later, PNC filed a motion to dismiss, arguing against Joyce’s claims of negligence and breach of fiduciary duty, as well as the jeweler’s request for attorneys’ fees and punitive damages.

The bank also argued it could only be sued only under the state’s Uniform Commercial Code, which guides commercial business transactions, including wire transfers.

Earlier this year, the state court’s decision came back in favor of Joyce’s Jewelry.   

In a March 11 ruling, Judge Nancy D. Vernon said the court could not dismiss claims that PNC and individual bank employees acted negligently.

She also said the jeweler can continue to seek attorneys’ fees and punitive damages in the case.

In her ruling, the judge also noted that PNC’s duty to the jeweler goes beyond its contractual obligations and said the bank may still be liable for a tort, meaning an injury or wrong independent of an implied contract.

A spokesperson from PNC said, “PNC regrets that Joyce’s Jewelry was the victim of a crime and suffered financial losses. However, Joyce’s Jewelry could have avoided being defrauded had they taken the reasonable precautions recommended by PNC at any stage of this process.

“Although the court denied PNC’s requested relief at this stage, PNC expects the facts and law will ultimately establish that PNC is not liable for Joyce’s Jewelry’s losses.”

Howard Kaplan, partner at the law firm Kaplan & Grady and Joyce’s Jewelry’s counsel, shared some insight into the case and what it could mean for other small businesses in this situation.

The recent ruling is significant, he said, because that’s not usually how these cases play out.

“Usually, [these cases] are under a very narrow legal theory and individual bank employees are not put in the mixer. And punitive damages aren’t a question, nor is tort liability for negligence,” he said.

“Usually, disputes with bank customers are a creature of contract, as opposed to tort or negligence. So, the liability on a negligence theory is broader. The potential damages and liability are broader than on a contract theory,” said Kaplan.

If the bank was able to confine the lawsuit to the Uniform Commercial Code claim, it likely would have limited the damages it may have to pay. 

The judge’s March 11 ruling is “a really bad development for [PNC] because they don’t want their employees getting sued, and they don’t want to be exposed to open-ended damages,” he said.

The damages are, in part, for “gaslighting” the jeweler into believing the fault was solely theirs, and for sending the business into collections and risking its livelihood, Kaplan said.

As for how much, that’s a question for the judge and jury.

“What is it going to take to send a message to PNC that the way that they’ve treated their customer in this instance was unacceptable? And I would think that it would take a large number to send a message to them, likely a multiple of Joyce’s loss,” he said.

“The bank here is spending more on their defense than it would cost to pay Joyce’s back. They will spend more than a million dollars through trial to avoid doing right by their customer.”

Beyond the legal implications of the case, Kaplan said he wants people to understand the reality and relatability of the situation.

“They’re going to blame a 70-year-old woman for making a mistake on her computer and say what resulted—collection of all of Joyce’s cash into one account and then shipping that money out in 11 highly suspect wires over the course of 20 hours—is all fair and OK,” he said. “It’s really offensive from a common-sense perspective.”

“We didn’t say that Joyce’s did everything right. But PNC is required to have reasonable security and is required to follow those reasonable security measures in a reasonable way,” Kaplan said.

“And the facts of the case seem to show that one or the other isn’t true. Either you didn’t have the proper security in place, or you all were asleep at the switch, but it has to be one or the other because of what happened,” he said.

The case is in the preliminary stages, but Kaplan’s hope is that others in this situation can take the same approach.

“If we actually win the case, and I am confident that we will, then that roadmap will just be that much more useful and hopefully it will lead more broadly to better recoveries for defrauded customers, and there are many more out there,” said Kaplan.