The perpetrators reportedly swiped the personal details of their victims (such as Social Security numbers) in order to get access to their bank accounts and credit cards. After that, they went to town with attempts to transfer money, go on virtual shopping sprees or take further control by changing account details.

Prosecutors haven't yet asked for Locsin to be extradited to the US. However, the penalties could be severe -- he faces up to 30 years in prison if he's convicted. Even if there's a lighter sentence, it'll be clear that stealing sensitive info (at least, from the wrong people) can carry a steep price.