Vladimir Leonidovich Levin

Background

Vladimir Leonidovich Levin is a Russian man from St. Petersburg who, according to contemporaneous press accounts, held a degree in biochemistry and mathematics from the Saint Petersburg State Institute of Technology (also referred to in some sources as St. Petersburg Technological University). He reportedly worked as a computer programmer for a St. Petersburg-based computer company. He became internationally known in the mid-1990s after being accused of masterminding a scheme to fraudulently move millions of dollars out of Citibank corporate accounts using remote computer access.

The Citibank Intrusion

Between mid-1994 and later that year, unauthorized transactions were made against the accounts of several large corporate customers of Citibank through the bank's dial-up, X.25-network-based wire-transfer service, known at the time as the Financial Institutions Citibank Cash Manager. Using obtained customer codes and passwords, the intruder logged into the system on multiple occasions—reported as 18 separate sessions over a period of weeks—and initiated wire transfers to accounts that had been opened by accomplices in the United States, Finland, the Netherlands, Germany, and Israel. Citibank stated the attempted fraudulent transfers totaled approximately $10.7 million, of which around $3.7 million was actually moved through completed transfers before the scheme was detected and disrupted.

Investigation and Arrest

Citibank detected the irregular transfers and worked with law enforcement, including the U.S. Federal Bureau of Investigation, to trace the transactions and identify the accomplices who had opened the receiving accounts in multiple countries. Levin was identified as a central figure in the scheme. In March 1995, he was apprehended by Scotland Yard officers at Stansted Airport near London while making a connecting flight originating from Moscow.

Extradition Fight

Levin contested extradition to the United States for roughly two and a half years, pursuing appeals through the British court system, including to the House of Lords, which rejected his final appeal in mid-1997. In September 1997 he was extradited and transferred into U.S. custody to face trial in the U.S. District Court for the Southern District of New York.

Conviction and Sentence

As part of a plea agreement, Levin pleaded guilty to a single count of conspiracy to defraud, admitting responsibility for the $3.7 million actually transferred rather than the full $10.7 million Citibank had reported as targeted. In February 1998 he was sentenced to three years in prison and ordered to pay Citibank restitution of $240,015. Several accomplices who had opened or controlled the receiving accounts in different countries were separately prosecuted and pleaded guilty to related conspiracy charges. Citibank stated that it ultimately recovered all but about $400,000 of the stolen funds.

Legacy

The Citibank case is frequently cited as one of the earliest large-scale, internationally prosecuted cases of computer-based bank fraud, and it is sometimes referenced informally as an early example of a remote "online bank robbery." Later technical accounts and retrospectives have noted some ambiguity and dispute over exactly how the initial access credentials were obtained and how much of the intrusion work was Levin's own versus that of other St. Petersburg-based individuals, but the prosecution, extradition, and conviction of Levin himself are well documented in court and press records. The case is commonly discussed in histories of banking cybersecurity as an early illustration of the risks posed by remote access to funds-transfer systems and of the jurisdictional complexity involved in prosecuting cross-border computer fraud.

Timeline

• 1994Unauthorized wire transfers begin against corporate customer accounts on Citibank's dial-up Cash Manager funds-transfer system, eventually totaling roughly $10.7 million attempted and about $3.7 million completed.
• 1995-03Levin is arrested by Scotland Yard at Stansted Airport, London, while transiting from Moscow.
• 1997-06The House of Lords rejects Levin's final appeal against extradition to the United States.
• 1997-09Levin is extradited to the United States to face trial in the Southern District of New York.
• 1998-02Levin pleads guilty to conspiracy to defraud and is sentenced to three years in prison, plus $240,015 in restitution to Citibank.