This month, a judge in Pennsylvania allowed a lawsuit to move forward against PNC Bank and some of its employees individually over $1.1 million in fraud losses suffered by a local jeweler in 2022.
While the lawsuit concerns a small amount of money relative to the size of PNC's annual revenue last year of $32 billion, the case could set a costly precedent for it and other banks should the Pennsylvania state court rule in favor of the plaintiff, Joyce's Jewelry. On preliminary requests by PNC to dismiss the charges and end attempts at recovering attorneys fees, the judge has ruled for Joyce's.
The preliminary ruling is a "wake-up call to bankers," according to Howard Kaplan, an attorney representing Joyce's in the matter.
"The ruling is significant, showing that individual bank employees may have liability for their failure to train customers on security procedures or their failure to react properly after a fraud occurs," Kaplan said. "Further, the court said that PNC and PNC employees individually may be liable for punitive damages and attorney's fees for their conduct."
PNC did not immediately respond to a request for comment. A spokeswoman for the bank previously said the bank maintains a "comprehensive set of security controls to protect customers from increasingly sophisticated online banking schemes.
"While PNC regrets any losses incurred by any customer, it disagrees with the allegations in this case and believes it acted appropriately with respect to these transactions," the spokeswoman said.
Joyce's, a jeweler based in Uniontown, Pennsylvania, sued PNC in 2022 after one of its employees accidentally gave fraudsters the username and password for her administrator-level account held with PNC Bank. The jeweler claimed PNC stopped only one of 12 fraudulent wire transfers initiated thereafter, and that the bank's two-factor authentication system failed to prevent the transfers.
On March 12, 2022, a Joyce's employee googled PNC's wire transfer service Pinnacle and clicked on the first link, which turned out to be a spoof site. The employee entered her credentials, and by the next day, fraudsters used the stolen credentials to wire themselves more than $1.6 million, out of Joyce's accounts. Joyce's alleges that PNC failed to implement security protocols that required more than one employee's account to authorize such wires.
The plaintiffs allege that the banks did not catch obvious red flags or implement proper safeguards such as requiring two employees to approve each transaction.
After PNC partially recovered the stolen funds (and charged Joyce's for the recovery efforts), Joyce's calculated its total losses to be $1.1 million, which it sued PNC to get back. The case went before the civil division of a state court — the Court of Common Pleas of Fayette County, Pennsylvania.
PNC asked a federal court — the U.S. District Court for the Western District of Pennsylvania — to take up the matter from the state court. However, on Jan. 12, 2023, PNC suffered its first setback in the lawsuit, with the federal court ruling the state court should continue to handle the case.
This month, PNC suffered another setback after the state court ruled it could not dismiss claims by Joyce's that PNC and individual employees at the bank acted negligently in the matter.
The ruling by judge Nancy D. Vernon, dated March 11, states that Joyce's may also continue to seek attorneys' fees and punitive damages in the case, which could inflate the price of the lawsuit far above the original $1.1 million loss the jeweler claims it suffered.
Vernon said in the ruling that viewing Joyce's claims in "a light most favorable" would suggest PNC may owe the jeweler the money it lost, but a judgment on Joyce's claims is still to come, and the preliminary findings do not guarantee the bank will have to pay any damages.
The judge also indicated that PNC's duties to Joyce's extend beyond its contractual obligations, namely, that PNC may still be liable for a tort, which is the law term for an infringement of a noncontractual right. In other words, PNC's duties to Joyce's existed "independently and regardless of" the contractual relationship between the two, according to the ruling.
