Evaldas Rimasauskas, 48, of Vilnius, Lithuania, pleaded not guilty in Manhattan federal court to charges of wire fraud, money laundering and aggravated identity theft.
He arrived in New York last night after failing to block extradition from Lithuania, where he was arrested in March.
US prosecutors, continuing a policy of treating large corporations like human crime victims, did not identify the companies in court documents. But they were named in a Lithuanian court document, which said Google sent over USD 23 million and Facebook sent nearly USD 100 million to bank accounts controlled by Rimasauskas between 2013 and 2015.
Robert Peabody, a lawyer for Rimasauskas, said outside court that the defence team will "make sure he gets a good defence."
More From This Section
If convicted, Missuses could face decades in prison, though most defendants in financial fraud cases spend much shorter amounts of time incarcerated. If convicted of the aggravated identity theft charge, Rimasauskas would face a mandatory minimum sentence of two years in prison.
In a release at the time of Rimasauskas' arrest, Acting US Attorney Joon H Kim said the case "should serve as a wake- up call to all companies -- even the most sophisticated -- that they too can be victims of phishing attacks by cyber criminals.