The US Department of Justice has extradited two Romanians to the US, where they face charges in connection with a massive phishing scam.
The two men, Petru Belbita, 25, and Cornel Tonita, 28, are accused of setting up fake phishing sites designed to steal user names and passwords from the Web customers of major financial institutions.
Victims would receive e-mails or text messages that looked like they came from legitimate financial institutions, said Assistant US Attorney Mark Aveis. "You'd of course freak out and be concerned that your account was under attack," he explained. "You'd click a link and that link would take you to what you thought was a legitimate [bank] site."
In fact it was a fake site. And once the phishers had this information, they'd send it to US based "cashiers," who would manufacture fake cards with the information. They would then hand over those cards to "runners" who would go from bank to bank withdrawing money.
The Romanians preferred to work with runners located in the US because they had more cash machines to choose from, Aveis said.
The phishers and the cashiers would meet in online "carder" Web sites to buy and sell stolen IDs, Aveis said.
A third alleged co-conspirator, Ovidiu-Ionut Nicola-Roman, also of Romania, became the first foreign national convicted in the US of phishing. He was sentenced to more than four years in prison in March.
All of the charges stem from a May 2008 phishing sweep by US authorities that led to charges against about 40 people, all with ties to international organised crime, according to the Department of Justice. More than half of those involved in the alleged conspiracy are still at large, most of them in Romania, the DoJ said.
Cyber security experts say that Romania has been a top source of phishing for the better part of the past decade. In 2006 the US Federal Bureau of Investigation's Cyber Division dispatched six FBI agents to Bucharest to work with Romanian National Police. Last year the FBI conducted two phishing crackdowns, including the May 2008 action that led to Belbita's and Tonita's charges.
The two men now face more than 30 years in prison on the charges.
Belbita was arrested in Montreal on 24 January and extradited on Friday. Tonita was arrested in Dubrovnik, Croatia, on 18 July and extradited on 4 September. Both men have pleaded not guilty to the charges.