In May, authorities in the US and Romania arrested and charged 38 people suspected of running an international phishing gang.
The 26-year Sergiu Popa led victims to bogus websites and tricked them into revealing their PIN codes and other personal information.
He was also offering phishing kits for sale with instructions on how to counterfeit credit cards.
Popa, who was extradited to the US from Spain in June, now faces up to 10 years in jail or a fine of over £290,000.
Graham Cluley, technology consultant at IT security supplier, Sophos, said: "There are plenty of other criminals taking advantage of innocent internet users and stealing identities from the unwary."
He said all computer users should ensure they are fully defending against attacks such as phishing and that they exercise caution when responding to emails that ask for financial information.