Russian National Extradited to United States for Bank Account Takeover Fraud Scheme Causing Millions of Dollars in Losses

ATLANTA - Sergei Anatolyevich Filimonov, a Russian national and web developer who was extradited from the Republic of Georgia, appeared in federal court last week on fraud and aggravated identity theft charges stemming from his alleged role in a transnational conspiracy responsible for large-scale bank account takeovers.

"This investigation and indictment underscore our commitment to disrupting large-scale cyber theft," said U.S. Attorney Theodore S. Hertzberg. "With assistance from our international partners, we will relentlessly pursue those who weaponize technology for personal gain and hold them fully accountable in an American courtroom."

"Filimonov allegedly used spoofed domains and fraudulent login pages to target unsuspecting online banking customers, stealing millions from victims," said Marlo Graham, Special Agent in Charge of FBI Atlanta. "This announcement is a powerful demonstration of the value of our partnerships on cybercrime, without which these extraditions and arrests would not be possible."

According to U.S. Attorney Hertzberg, the charges, and other information presented in court: from November 2023 through October 2025, Filimonov and his co-conspirators executed a sophisticated scheme involving spoofed domains that mimicked the websites of federally insured financial institutions. The conspirators purchased sponsored search-engine links to divert unsuspecting banking customers to fraudulent login pages, where victims entered their credentials. The conspirators used the stolen credentials to access bank accounts, review account balances, and initiate unauthorized wire transfers to steal bank account funds.

The indictment also alleges that Filimonov developed and maintained online infrastructure supporting the operation, including interactive databases storing more than 5,000 stolen login credentials and software designed to capture and transmit sensitive authentication data. Filimonov and his co-conspirators allegedly attempted to obtain millions of dollars from victim accounts, including accounts held by companies located in the Northern District of Georgia.

In connection with the charged scheme, the Department of Justice previously seized the domain web3adspanels.org, which operated as a backend server storing stolen credentials harvested from fraudulent banking websites. The seized server contained thousands of compromised credentials, including those belonging to victims located in the Northern District of Georgia.

Since January 2025, the FBI Internet Crime Complaint Center (IC3) received more than 5,100 complaints reporting bank account takeover fraud, with reported losses exceeding $262 million. The public is encouraged to stay vigilant and to follow steps recommended by the FBI, including regularly monitoring financial accounts, using "Bookmarks" or "Favorites" for navigating to login websites, and guarding against phishing attempts.

On November 4, 2025, a federal grand jury returned an indictment charging Sergei Anatolyevich Filimonov, 36, of Russia, with conspiracy to commit bank and wire fraud; access device fraud conspiracy; multiple counts of bank, wire, and access device fraud; and aggravated identity theft. On September 4, 2026, Filimonov appeared before a federal magistrate judge in Atlanta and pled not guilty. If convicted on all charges, he faces a minimum of two years and a maximum penalty of 175 years in prison.

Members of the public are reminded that the indictment only contains charges. The defendant is presumed innocent of the charges, and it will be the government's burden to prove the defendant's guilt beyond a reasonable doubt at trial.

Filimonov is being held in the custody of the U.S. Marshals Service pending further proceedings.

This case is being investigated by the Federal Bureau of Investigation. Substantial assistance was provided by the Department of Justice's Office of International Affairs, the Estonian Office of the Prosecutor General, the Estonian Police and Border Guard Board, the Prosecutor General's Office of Georgia, the Georgian Central Criminal Police Department, and the FBI Office of the Law Enforcement Attaché in Tbilisi.

Assistant United States Attorney Jessica C. Morris and Senior Counsel Brian Mund of the Criminal Division's Computer Crime and Intellectual Property Section (CCIPS) are prosecuting the case. Former CCIPS Trial Attorney Jolee Porter assisted in the investigation.

For further information please contact the U.S. Attorney's Public Affairs Office at [email protected] or (404) 581-6185. The Internet address for the U.S. Attorney's Office for the Northern District of Georgia is http://www.justice.gov/usao-ndga.