How to catch a hacker: Follow the money

                 By most measures, those responsible for the Citibank caper were
                 world-class hackers - just really poor money launderers. 

                 When bank and federal officials began monitoring activities of a hacker
                 moving cash through Citibank's central wire transfer department, they
                 were clueless about where the attack was originating. 

                 Monitoring began in July and continued into October, during which
                 there were 40 transactions. Cash was moved from accounts as far
                 away as Argentina and Indonesia to bank accounts in San Francisco,
                 Finland, Russia, Switzerland, Germany and Israel. 

                 In the end, all but $400,000 taken before monitoring began was
                 recovered. 

                 The break came Aug. 5, when the hacker moved $218,000 from the
                 account of an Indonesian businessman to a BankAmerica account in
                 San Francisco. Federal agents found that account was held by Evgeni
                 and Erina Korolkov of St. Petersburg, Russia. 

                 When Erina Korolkov flew to San Francisco to make a withdrawal in
                 late August, she was arrested. 

                 By September, recognizing a St. Petersburg link, authorities traveled to
                 Russia. A review of phone records found that Citibank computers were
                 being accessed at AO Saturn, a company specializing in computer
                 software, where Vladimir Levin worked. 

                 By late October, confident it had identified the hacker, Citibank
                 changed its codes and passwords, shutting the door to the hacker. 

                 In late December, Korolkov began cooperating. Levin and Evgeni
                 Korolkovone were arrested at Stansted Airport, outside London, on a
                 U.S. warrant March 4, 1995. 

                 Unknown is how the hacker obtained passwords and codes assigned
                 to bank employees in Pompano, Fla., and how he learned to maneuver
                 through the system. 

                 Citibank says it has found no evidence of insider cooperation with the
                 hacker. 

                 By USA TODAY 


                 ©COPYRIGHT 1997 USA TODAY, a division of Gannett Co. Inc.