Several financial Institutions are facing a lawsuit filed by an elderly 74-year-old Hilton Head retiree, Shirley A. Lucas, after she was scammed out of nearly $500,000. The lawsuit filed in Beaufort County names PayPal, Bank of America, and Wells Fargo as defendants and accuses them of negligence because they failed to question or stop the fraudulent transactions made against Lucas. As such, the lawsuit accuses the financial institutions of violating state and federal consumer protection laws.

Court documents detail that the fraudulent activity began in the Spring of 2022 and continued through most of that year. The victim allegedly received email correspondence from a scammer pretending to be affiliated with PayPal. Lucas fell for the scammer's message and proceeded to download an email attachment software cloaked as a system that would help her receive “customer support.”

Instead of being legitimate software from a legitimate company, the scammers were able to successfully download a remote desktop protocol onto the victim's computer. This remote desktop protocol enabled the scammers to have full access and control over her computer system. With this access, the scammers were able to collect sensitive data including personal information, usernames, and passwords of several of her bank accounts among other credentials.

After collecting the pertinent data, the scammers were then able to hack her financial institutions and transfer money out of her bank account and into their own accounts. The scammers were also able to make purchases including gift cards and cryptocurrency. Over the course of 2022, the scammers were successfully able to transfer nearly $500,000 out of nearly a dozen accounts.

The lawsuit details that over $197,000 was stolen from Lucas’ Bank of America account, over $76,500 was taken from her Wells Fargo accounts, over $173,000 was taken from her Wells Fargo retirement accounts, and $25,000 of fraudulent purchases were made through her PayPal account.

The financial institutions are facing several accusations including failing to follow “Know Your Customer” rules — rules that are designed to help financial institutions determine if an individual’s transaction history matches their expected and usual behavior.

Additionally, the financial institutions are accused of failing to follow anti-money laundering rules, failing to follow their own protocols to determine whether fraud is occurring, and failing to monitor accounts for suspicious activities.

The lawsuit explains, “If Defendants followed such rules, particularly in the recognition and hold of transactions that clearly fit known patterns of fraud, senior citizens such as Plaintiff can be protected from the danger of losing all or nearly all of the life savings meant to sustain them in retirement; if these rules are not followed, grievous financial harm inflicted can result.”

Lucas’ son, Nathan, shared with The Island Packet and Beaufort Gazette, “I’ll never forget that day,” recalling the day he received a text from an unknown number. “It said something like ‘your mom is part of a very big scam and we’re about to go after the last of her money, which is in her investment accounts.’”

Nathan details how he received numerous documents highlighting the swath of data the hackers had on his mother and his 97-year-old grandmother. “It’s such a tangled web that they weave,” he explained. “I think I had to lock down 22 accounts across 11 financial institutions.”

The lawsuit alleges that because of the negligence of the financial institutions, Lucas suffered unspecified damages. Among the violations detailed in the lawsuit include violation of the Fair Credit Billing Act, violation of the Electronic Fund Transfer Act, and failure to apply a limit of liability and comply with error resolution procedures.

The lawsuit is seeking unspecified damages including punitive damages, statutory damages, attorneys fees, and other damages.