A civil complaint alleges that a retired New Jersey man lost $390,000 in two days after a fake Norton/PayPal refund call escalated into a bogus PNC "mistaken deposit" story that induced him to wire savings to a gold dealer and collect the coins in person.
Social Engineering Examples·5 sources
Between June 5-6, 2024, a civil complaint alleges that a 76-year-old West Orange, NJ retiree and PNC Bank customer was defrauded of $390,000 in a "phantom hacker/courier" vishing scheme. It allegedly began with a fake Norton/Symantec antivirus billing email prompting a support call. The caller posed as a PayPal representative and manipulated an on-screen refund form to show a false $300,000 deposit. A second caller posing as PNC bank staff allegedly directed the retiree to wire funds to a coin dealer and purchase gold coins. The complaint alleges that a PNC branch processed a $300,000 wire to American Coin & Stamp Co. on June 5 and a $90,000 wire on June 6, after which the retiree collected coins and handed them to couriers. It further alleges that PNC and American Coin employees failed to intervene despite warning signs. West Orange police announced Jaynesh Patel's arrest in October 2024. The retiree later filed civil case ESX-L-001994-26 against Patel, PNC Bank, and American Coin & Stamp Co.
The scam began as a classic tech-support / refund vishing lure and pivoted mid-call into a fabricated bank-error narrative: (1) the retiree received a fake "Norton/Symantec Associates" billing email demanding he call a helpline about a small unpaid charge; (2) he called the number and reached a scammer (alleged alias "Jason Green") who claimed to be a PayPal representative and walked him through a "refund form," gaining remote access/screen control of his computer; (3) as the retiree typed a small refund amount (~$300), the scammer manipulated the screen to show $300,000 had been deposited into his account by mistake, using a doctored/forged PNC statement; (4) a "help line" phone number for his own bank appeared on the manipulated screen; the retiree called it and reached a second scammer (alleged alias "Edward Cullen") posing as PNC staff, who gave the retiree a short list of coin dealers and said the only fix was to wire the money to one of them and convert it into gold coins to return to the "bank"; (5) the retiree stayed on an open, active phone line with the scammer while physically at his PNC branch in West Orange, NJ, where a bank employee wired the funds directly to American Coin & Stamp Co.'s account, and then again while collecting the gold coins in person at American Coin's Clifton, NJ store, on June 5, 2024 ($300,000) and again on June 6, 2024 ($90,000, after the scammers invented a second "mistaken deposit"/reward-miscalculation story); (6) the purchased gold coins were handed to couriers who came to the retiree's home (vehicles later described as a black Nissan Rogue and a Honda with Pennsylvania plates). The hybrid's effectiveness rested on chaining three separate impersonations (antivirus vendor to payment processor to bank) so that each institution's "channel" (email, then phone, then in-person banking, then in-person retail) seemed to independently corroborate the last, and on keeping the victim continuously "on the line" so bank and dealer staff who were physically present never had a private moment to question him.
Lure: a routine-looking antivirus renewal/billing email (fake Norton/Symantec invoice) that escalates via phone to "we accidentally deposited too much into your account, please help us correct it," an urgency-plus-helpfulness frame that flips the victim from concerned customer to a person trying to do the bank a favor. Tell-tale signs that were missed or overridden: a "refund form" where a vendor remotely edits your entered dollar amount upward by 1000x; a bank "help line" number that appears only inside a remote-access/manipulated screen rather than on the back of a card or bank statement; being told by "the bank" that the fix for its own accounting mistake is for the customer to wire nearly his entire savings to a coin dealer and buy gold coins; and, most visibly to real-world witnesses, an elderly customer standing at a teller window or gold-dealer counter for two consecutive days moving nearly his entire net worth while audibly on an active phone call with an unidentified third party coaching him.
West Orange police reported that an investigation crossing state lines led to the October 2024 arrest of Jaynesh Patel of Bensalem, Pennsylvania, who was identified through a vehicle license plate. The later civil complaint alleges that Patel faced separate criminal charges connected with the scheme. The selected windows do not establish the disposition of those charges. The retiree also filed civil case ESX-L-001994-26 against Patel, PNC Bank, and American Coin & Stamp Co., alleging that the institutions failed to intervene despite signs of elder financial exploitation. Law.com reported on June 23, 2026 that PNC had lost a bid for dismissal; the selected extract does not establish a final judgment or settlement.
This case illustrates an alleged multi-stage vishing scheme that moved from an email lure to payment-processor and bank impersonation, then to in-person banking and precious-metals transactions while the retiree allegedly remained on the phone. The resulting civil complaint raises the question of whether the bank and precious-metals dealer had a duty to intervene when confronted with alleged elder-financial-exploitation warning signs. The selected sources do not establish a final ruling on that question.
Defenses relevant to this pattern include training bank staff to recognize customers being coached by phone during unusually large transfers; independently verifying payment instructions through known contact details; ending unexpected remote-screen sessions; and using official institution phone numbers rather than numbers supplied in an email or displayed during the session. Precious-metals dealers can also apply enhanced review to unusually large or repeated purchases when a customer appears to be receiving live instructions. These are preventive recommendations, not findings that any specific measure was legally required in this case.
Social Engineering Examples. “PNC Bank Gold-Conversion Vishing Fraud Targets a NJ Retiree (2024)”. Accessed 27 October 2026. https://socialengineeringexamples.com/pnc-bank-gold-conversion-vishing-nj-retiree-2024
the retiree received the fake billing email and called the embedded helpline number to dispute a charge he never authorized, self-selecting into the scam by initiating contact through attacker-controlled infrastructure.
Bulk lure infrastructure (spoofed vendor billing templates, purchased contact lists) is cheap for attackers to rotate and very hard to eliminate at the source; the realistic control is consumer-facing spam/phishing filtering and vendor public-awareness warnings, which is what West Orange police issued only after the fact.
Posing as a PayPal representative using the alleged alias "Jason Green," the caller directed the retiree to an online refund form. Police reported that the caller controlled and manipulated what appeared on the screen, changing a $300 entry to $300,000.
Consumer education that a legitimate vendor never requires disputing a charge by calling a number embedded in the billing email itself; look up the vendor's support number independently instead of using the one provided.
The scammer manipulated the shared screen to inflate a small refund into a fake $300,000 mistaken deposit, backed by a doctored PNC statement graphic, then routed the retiree to a second, coordinated persona ("Edward Cullen") posing as PNC staff via a phone number planted on that same manipulated screen, a classic two-persona handoff used to make the bank-impersonation stage feel independently corroborated.
Never grant remote computer access or complete an unsolicited "refund form" for a billing dispute; if access was already granted, end the session immediately and run a security scan before taking any further financial action.
The second scammer kept the retiree on an open phone line while coaching him, from a supplied list of coin dealers, to visit his PNC branch and treat the wire as the only way to "return" the mistaken funds, exploiting the fact that a phone call is invisible to anyone who doesn't ask about it.
Treat any phone number or account statement that appears only inside a remote-access or manipulated screen as inherently untrustworthy; verify by calling the institution back using a number from a card, a mailed statement, or the official website.
A PNC branch employee processed the wire transfer to the gold dealer's account without questioning the customer's age, the transaction's size, or the ongoing phone call, converting the scam from a digital manipulation into a real, largely irreversible bank transaction.
Bank and dealer staff trained on FinCEN elder-financial-exploitation indicators, an older customer visibly on an active phone call while being coached through an unusual transaction, should pause the transaction and ask direct questions or separate the customer from the call before proceeding.
the retiree collected the physical gold coins in person from American Coin & Stamp Co., again without staff inquiry despite visible phone coaching, then handed the coins to an unknown courier who arrived at his home in a vehicle later linked to the arrested suspect.
Mandatory friction for large wire transfers by senior customers, cooling-off holds, independent callback verification, or Adult Protective Services referral, especially when a similar transaction recurs on consecutive days.
The scammers reused the same open-line, fabricated-mistake playbook the next day, inventing a second "reward miscalculation" to extract an additional $90,000 in gold through the identical wire-then-courier pipeline, completing the theft before the retiree grew suspicious and reported it.
Precious-metals dealers applying "know your customer" checks (purchase history, size and frequency, visible phone coaching, first-time customer status) before releasing large same-week gold purchases, and treating an unfamiliar courier pickup at a customer's home as a fraud indicator worth reporting.
Browse by what this case has in common with others in the library.
A Singaporean finance professional in her 50s lost S$1.2 million (~US$900,000) over two months after scammers impersonating an Anti-Scam Centre…
A scammer spoofed a New Zealand bank's number and obtained authentication codes by claiming they would suspend banking and cancel…
Fraudsters spoofed Barclays' real phone number and hold music, posed as the bank's fraud team in a two-caller vishing script,…
Scheme participants posed as veteran finance professionals inside private WhatsApp investment groups to lure at least 18 U.S. retail investors…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A four-man Manhattan BEC ring used compromised business email accounts to redirect approximately $3.49 million and $2.0 million in wires,…
A trusted, decades-respected Kansas community bank CEO was groomed over WhatsApp into a crypto "pig butchering" scam, then embezzled $47.1…
DOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call…
Posing as NatWest bank security, vishing criminals convinced a Surrey solicitor to transfer £734,000 of client money to "safe" accounts.…
Under Operation Tri-Force Sentinel, Dubai Police raided at least nine pig-butchering scam centers in Dubai and arrested 275 people, with…
Unconnected fraudsters stuck fake QR-code stickers on council parking machines and signage across the UK, pasted over genuine PayByPhone codes…
KnowBe4 unknowingly hired a North Korean operative for a software engineering role after he passed four video interviews using an…
MGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown…
ESET researchers found "PromptLock," a Go-based ransomware sample on VirusTotal that used a locally-run open-weight AI model (gpt-oss:20b via Ollama)…
Two New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen…
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that…
Prosecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took…
Fugitive hacker Kevin Mitnick impersonated a vacationing Novell employee on a "top-secret" project, defeated a support analyst's voicemail-based identity check…
Anthropic reported that a single cybercriminal used Claude Code to automate attacks against at least 17 organizations and generate psychologically…
An unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its…
A Telegram/dark-web "blackhat ChatGPT" sold $200/month subscriptions promising AI-generated phishing pages, malware and BEC lures, but when Cisco Talos tried…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
In July 2020, callers posing as Twitter IT stole staff logins and hit 130 accounts, from Obama to Musk, with…