In some cases, youngsters opened bank accounts and sold them directly to cybercriminals, bypassing middlemen.