A 36-year-old Russian web developer appeared in a federal courtroom in Atlanta this week to face charges connected to an online banking fraud operation that prosecutors say used fake bank websites to drain victims' accounts nationwide. Sergei Anatolyevich Filimonov, who was extradited from the Republic of Georgia, is accused of building and managing the digital infrastructure behind a scheme that bought sponsored search links to funnel unsuspecting bank customers into spoofed login portals.
According to the Tampa Free Press, a federal grand jury in the Northern District of Georgia indicted Filimonov on November 4, 2025, on charges including conspiracy, fraud, unauthorized-access-device offenses, device-making equipment violations, and aggravated identity theft. The spoofed websites at the center of the case were designed to resemble legitimate, federally insured financial institutions, and the group is accused of attempting to steal millions of dollars from victims across the country, including corporate accounts based in the Northern District of Georgia.
How the Scheme Allegedly Worked
Investigators say the conspirators bought sponsored links on major search engines to direct online banking customers to fake login portals. Search-engine malvertising lets criminals purchase sponsored links on platforms like Google and Bing to intercept banking customers while they search for official login pages, according to Security Affairs. Once victims typed in their credentials on the fake sites, the report notes, the conspirators collected usernames and passwords, logged into the genuine bank accounts, checked victims' balances, and sent unauthorized wire transfers to drain the funds.
Filimonov's setup allegedly included software designed to capture authentication data along with interactive databases holding stolen account credentials. A database search tied to the case reportedly revealed thousands of compromised logins from victims across the country and in the Atlanta area, per the same account. The backend domain that served as the storage hub for the harvested credentials, web3adspanels.org, was seized by the U.S. Department of Justice, and when federal authorities took down that server in December 2025, investigators linked the credential-harvesting database to at least 19 victims, roughly $14.6 million in confirmed losses, and about $28 million in attempted losses, according to the U.S. Department of Justice.
A Two-Year Operation and a Global Manhunt
Federal court documents state that the credential-harvesting operation Filimonov managed continued as recently as November 2025, before law enforcement seized the backend domain, the Justice Department says. His extradition from the Republic of Georgia required international coordination involving the FBI Legal Attaché in Tbilisi along with police and prosecutorial assistance from Estonia and the Republic of Georgia. The Justice Department's Office of International Affairs also assisted, and the FBI Atlanta Field Office is conducting the ongoing investigation.
A. Tysen Duva of the Justice Department's Criminal Division announced the charges, and U.S. Attorney Theodore S. Hertzberg also announced the charges on behalf of the Justice Department. Marlo Graham announced the charges for the FBI's Atlanta Field Office. Prosecutors Jessica Morris and Brian Mund are handling the case for the Justice Department.
Steep Penalties Under Federal Law
Filimonov faces a statutory maximum sentence of up to 175 years if convicted on all counts, and a mandatory minimum of two years if convicted. That mandatory minimum stems from 18 U.S.C. § 1028A, which requires that aggravated identity theft convictions carry a two-year prison term running consecutively to any underlying bank and wire fraud sentences, according to the Spodek Law Group. That consecutive-sentencing structure sharply limits judicial discretion and is what drives the case's enormous maximum exposure.
The case arrives amid a broader surge in account-takeover fraud. The FBI's Internet Crime Complaint Center has logged over 5,100 account-takeover complaints since January 2025, accounting for more than $262 million in reported losses, per the Tampa Free Press report. According to the FBI Internet Crime Complaint Center, IC3 serves as the central hub for reporting cyber-enabled crime, including account takeover and business email compromise. Nationally, the Federal Trade Commission reported that imposter scams were the most reported fraud category in 2025, with Americans reporting $3.5 billion in losses — a nearly threefold increase since 2020, contributing to a record $16 billion in overall reported fraud losses that year, per the Federal Trade Commission. According to the Federal Trade Commission, scammers commonly use email or text messages to trick people into surrendering personal and financial information.
Older Adults Bear a Disproportionate Toll
Older adults have been hit especially hard by this style of fraud. The FBI's Internet Crime Complaint Center found that adults aged 60 and over lost $7.7 billion to internet crime in 2025, a 60% increase from 2024 driven largely by online impersonation and credential theft, according to The Northern Light. Banking customers are advised to regularly monitor their accounts, verify search results before clicking, and use browser bookmarks instead of search engines to reach online banking portals.
The prosecution follows a string of extradition and cybercrime cases handled by the U.S. Attorney's Office for the Northern District of Georgia. Danish researcher Poul Thorsen was extradited and prosecuted in another case. It also echoes FBI Atlanta's takedown of the W3LL phishing kit in April, which harvested credentials to facilitate more than $20 million in global business email compromise and fraud attempts. Investigators have not disclosed the identities or whereabouts of any unindicted co-conspirators, nor whether any of the $14.6 million in confirmed stolen victim funds has been recovered, and Filimonov's trial schedule in Atlanta has not yet been set. The Cybersecurity and Infrastructure Security Agency says that reporting suspicious activity or strange behavior plays an essential role in keeping communities safe and secure.
