Two defendants prosecutors say played leading roles in an international account takeover and ATM cash-out scheme that defrauded U.S. consumers and businesses out of more than $15 million pleaded guilty this week to charges of wire fraud, access device fraud and identity theft.

Al Pascual, a lead analyst at consultancy Javelin Strategy & Research, says the guilty pleas in this case are not surprising because of the strong evidence prosecutors had gathered.

"The challenge of the past few years for the DoJ [Department of Justice] has been locating and often extraditing those responsible," he says. "These defendants were based in the U.S., but for those located in non-cooperative locales, such as Eastern Europe and elsewhere, more still needs to be done to facilitate their arrest and extradition."

Robert Dubuc of Malden, Mass., and Oleg Pidtergerya of Brooklyn, N.Y., entered guilty pleas before a federal judge on March 31, according to the New Jersey U.S. Attorney's Office. Each faces up to 20 years in prison for wire fraud conspiracy and up to five years for conspiracy charges related to device fraud and identity theft. Each count also carries a maximum $250,000 fine, or twice the gross gain or loss from the offense.

Dubuc's sentencing is set for July 7; Pidtergerya will be sentenced July 8.

Prosecutors say Dubuc and Pidtergerya helped to manage the U.S.-based operations for a global cash-out scheme that involved hijacking funds from online bank accounts and prepaid cards, which were opened with stolen identities (see How to Fight Prepaid Card Fraud).

The scheme was linked in June 2013 to an international cybercrime ring that hacked customer accounts at more than a dozen banks, brokerage firms, payroll processing companies and government agencies, authorities say (see Another Huge Cash-Out Scheme Revealed).

Dubuc and Pidtergerya allegedly worked with Oleksiy Sharapka and Leonid Yanovitsky, both of Kiev, Ukraine, who allegedly directed the conspiracy, prosecutors say. Both Sharapka and Yanovitsky are under indictment and remain at large.

Pidtergerya managed a cash-out crew in New York, while Dubuc controlled a crew in Massachusetts, prosecutors say.

In entering their guilty pleas, Dubuc and Pidtergerya admitted they were aware fraudulent accounts and cards were created without the consent of the individuals in whose names they were opened, according to court records. And both men admitted to coordinating fraudulent ATM and bank withdrawals to steal funds, authorities say. They also admitted to sending their proceeds to Sharapka and Yanovitsky in Ukraine.

The Scheme

Hackers allegedly intercepted account and cardholder data after gaining unauthorized access to computer networks of global financial institutions and organizations, including Aon Hewitt; Automated Data Processing Inc.; Citibank N.A.; E-Trade; Electronic Payments Inc.; Fundtech Holdings LLC; iPayment Inc.; JPMorgan Chase Bank N.A.; Nordstrom Bank; PayPal; TD Ameritrade; the U.S. Department of Defense; the Defense Finance and Accounting Service; TIAA-CREF; USAA and Veracity Payment Solutions Inc.

After obtaining unauthorized access to the bank accounts, Sharapka and Yanovitsky allegedly diverted money to bank accounts and prepaid debit cards they controlled. They then used hired crews known as "cashers" to withdraw funds from the fraudulent accounts through ATM withdrawals and fraudulent purchases in New York, Massachusetts, Illinois, Georgia and elsewhere, prosecutors say.