A week after accounts were restored at Hilltop Bank following a massive cyber security breach, customers are reporting unauthorized and unfamiliar charges on their accounts as well as floating payments and balances that don't match what they expected to have available.
Alyssa Schwindt of Casper was on hold with Hilltop Bank when Cowboy State Daily reached out to her. She had already been waiting for about 45 minutes, she said in a Facebook message.
She later told Cowboy State Daily in a phone interview she had been trying to track down $519 in charges that appeared to be pending on her account, even though she already confirmed that most of those bills had been paid.
Schwindt said she attempted to withdraw $1,500 for rent and was told she had only about $1,100 available. A bank customer service representative explained that another $519 in transactions was still "floating" on the account.
The charges included payments to her cellphone provider, AutoZone and Walmart.
Schwindt said she contacted Verizon after seeing the cellphone charge. A Verizon employee confirmed her latest payment had already posted to her account, she said.
That left Schwindt wondering what would happen to the Hilltop transaction still showing on her bank account.
The Verizon employee told her the payment would not be sent again because she did not owe anything on her account, Schwindt said.
That raised another concern: Could she end up being charged twice?
"They said if it's double-charged, I can try to dispute it," Schwindt said. "They said, 'Good luck.'"
Schwindt said she also overheard another customer at the bank who appeared to be dealing with a similar problem.
"There are tons of people having these problems and I don't understand how we can go about it because it's their word against ours," Schwindt said. "I don't know about you, but I freak out when I don't know where $30 goes. This is $519."
Hilltop Bank spokesman Bill Salvin said in an email to Cowboy State Daily that customers who maintained accurate records of their transactions have not been affected. He said there has been no evidence any customer data or accounts have been compromised since they were restored.
“The charges were delayed in posting to accounts,” Salvin said. “However, they should not have been unanticipated.”
Hilltop has acknowledged it was processing transactions that accumulated while its systems were offline. During the restoration process, the bank said its teams were working to process backlogged transactions.
A Backlog Of Bills
In Glenrock, Annastacia Potter was sorting through questions of her own.
Her husband, a truck driver who was on the road this week, was unable to pay for his own meal Tuesday night because no money was available in their account, Potter said.
When Hilltop's accounts came back online, Potter said she believed the balance displayed represented the money available for them to spend.
Then a backlog of charges that had not gone through while the bank's systems were offline began hitting the account.
"Why is it just now coming through?" Potter said. "It should have been accounted for."
Potter said the bank also canceled payments to a DJ and caterer for her wedding, which took place shortly before the cybersecurity incident.
She said she has so far been unable to get answers. Her husband has tried to call Hilltop but has had difficulty getting through.
"It just rings and rings," she said. "I think it's because we're not the only ones."
Salvin said the bank will work with clients who have a situation where accounts are overdrawn.
“Each situation is unique,” he said. “Some may require loans while others may have other options.”
The issue comes after Hilltop spent several days gradually restoring its banking systems.
Personal mobile banking returned Sept. 21, while Hilltop said all personal banking systems were operational by Sept. 22. The bank said its IT teams had also been working through the weekend to process transactions that accumulated while its internal systems were offline.
The bank's Sept. 20 update also warned that ATM receipt balances did not yet reflect transactions that occurred while systems were offline.
Unfamiliar Charges
Other customers have raised questions about charges they don't recognize.
Misty Waugh said on social media she discovered several charges she did not recognize or understand through Chime, a financial technology company that provides banking services through partner banks.
She said she immediately moved her money out of the account.
Other customers chimed in with similar questions and concerns about transactions appearing after the bank's systems were restored.
Hilltop warned customers during the outage that scammers could try to exploit the situation by impersonating bank representatives or sending fraudulent emails, texts or phone calls.
The bank advised customers not to provide passwords, account information, Social Security numbers, banking details or verification codes to unexpected callers or messages.
Salvin said to the bank’s knowledge the disruption had not led to secondary scams on customers.
“The typical bank scams that affect anyone with a bank account continue,” he said. “However we, along with many other banks, have tried to warn people and educate them on those types of scams.”
What Happened?
Hilltop first began experiencing problems with its information technology systems on Sept. 8.
The bank initially described the problem as interruptions affecting online and mobile banking. Overnight, its IT team determined that the underlying problem was a cybersecurity incident.
As a precaution, Hilltop disconnected its banking systems – including its backup system – from the internet to isolate the incident.
During the outage, customers were largely unable to access online and mobile banking. Debit-card transactions were limited to $1,000 per day, while scheduled payments through Hilltop, including some mortgage, automobile and credit-card payments, could not be processed.
Hilltop said it would reimburse customers for late charges or fees resulting from the incident.
The bank gradually restored services, with branches reopening and phone service returning before online banking. Personal mobile banking came back Sept. 21, and Hilltop said its personal banking systems were fully operational Sept. 22.
But restoration did not necessarily mean every transaction was immediately reflected in customers' accounts.
Hilltop said its teams were processing transactions that had accumulated while the bank's systems were offline – creating another layer of uncertainty for customers who had been relying on the balances they could see once their accounts became accessible again.
Salvin has not said where the cyberattack came from.
“The technical details of the cyber incident are not something we are able to discuss,” he said.
'We Became The Guinea Pigs'
Schwindt has been banking with Hilltop for about a year. She said she switched to the bank after being scammed by a previous online bank.
Now, she said, she is considering finding another bank.
Potter acknowledged she bears some responsibility for not keeping a paper trail of her family's finances.
"We fell into the era of technology and we became the guinea pigs," she said. "It sucks to say that."
For customers like Schwindt and Potter, the question now isn't simply whether Hilltop's online banking system is working.
It's whether the numbers on the screen accurately reflect what they can spend – and whether they can trust the charges appearing in their accounts.
Hilltop's temporary incident website, hilltopbankupdates.com, posted its most recent update Sept. 24.
"We don't anticipate further updates now that systems are operational," the update said.
Kate Meadows can be reached at kate@cowboystatedaily.com.
