Three people who were accused of helping to steal $2 million from Citibank customers using stolen debit card numbers and PINs have pleaded guilty to access device fraud and federal conspiracy charges. The trio—Ivan Biltse, Angelina Kitaeva, and Yuriy Rakushchynets—used stolen card numbers to withdraw cash from ATMs across New York and sent the proceeds to Russia.

The story goes back to 2007, when a hacker from Russia apparently cracked Citibank's ATM server and was able to steal account and PIN numbers when people withdrew money from various cash machines. That hacker then had Rakushchynets, Biltse, and Kitaeva—along with up to seven others located in the US—burn those card numbers to the mag-stripes of fake debit cards, which were then used to withdraw cash from those accounts.

As recounted by Wired, in one way or another, many of the mules in the US managed to get caught in the months after Citibank finally reported the breach to the FBI. Rakushchynets was tied to the scheme after he was seen on ATM surveillance photos, while others were caught with blank cards and a mag-stripe writer in their car when they were pulled over for a traffic stop. Another participant was caught withdrawing money from an ATM where $180,000 had already been stolen in recent days.

In the end, Kitaeva, Biltse, Rakushchynets, and Rakushchynets' wife were charged with access device fraud, conspiracy, bank fraud, money laundering, and obstruction of justice. Olena Rakushchynets allegedly tried to destroy the contents of a safe deposit box "with the intent to impair the object's integrity and availability for use in one or more official proceedings," according to court documents. Biltse was also charged with passport fraud and illegally becoming a US resident through a fake marriage.

The team eventually pleaded guilty to various charges during the months of September and October this year, with Rakushchynets pleading guilty to the most charges (access device fraud, conspiracy, bank fraud, and money laundering). According to court documents, the parties involved will be in plea negotiations until tomorrow (November 7, 2008), at which time the updated status of the case will be determined.

Further reading:

* If you have PACER access, search for case number 1:08-cr-00384-BMC-3