OKLAHOMA CITY — Three men have admitted stealing several thousand dollars from an Oklahoma-based bank via an illegal practice known as “ATM jackpotting.”
Chevalier Jesus Martinez, 42; Wilfredo Lezama-Garcia, 34; and Clever Medina-Martinez, 21, pleaded guilty in Western District federal court here to a felony charge of conspiracy to commit bank theft.
ATM “jackpotting” is “a relatively new scheme where criminals install malicious software and/or hardware” in automatic teller machines that “forces the machines to spit out large amounts of cash on demand,” an agent with the U.S. Secret Service Cyber Crimes Task Force wrote in a search warrant affidavit.
Malware enables thieves to control ATMs and command them to dispense large amounts of cash repeatedly until the machines are empty, federal investigators report.
Jackpotting often targets financial institutions that operate stand-alone ATMs inside big-box retailers, gas stations and convenience stores, the agent related.
Criminals gain physical access to the cash machine, then install malware or specialized electronics – “often a combination of both” – to control operations of the ATM, the agent wrote.
With a ‘man-in-the-middle’ attack, a device is placed between the ATM and its wireless communication box, thereby altering communications between the ATM and the card processing service. This device and/or software “allows the criminals to force the ATM to receive an approved withdrawal transaction and dispense cash,” the Secret Service agent explained.
Criminals often target multiple ATMs in the span of a couple of days “before fleeing the area with little risk of being caught due to the difficulty of identifying and responding to a jackpotting attack in progress,” the agent said.
Jackpotting attacks – such as those that affected Tulsa-based Bank of Oklahoma – often are not detected until the financial institution or ATM service provider conducts a reconciliation of the targeted machine.
TransFund, a subsidiary of Bank of Oklahoma, was victimized by a series of ATM jackpotting attacks in Oklahoma City “and other areas throughout the region,” the bank related in a lawsuit. Some 118 jackpotting attacks on TransFund ATMs resulted in losses that exceeded $7.3 million, Bank of Oklahoma reported.
Federal prosecutors allege that on Jan. 23, 2022, several individuals conducted a successful jackpotting attack at a TransFund ATM inside a convenience store in northwest Oklahoma City. Data from TransFund identified a magnetic stripe card bearing the last four numbers of “1421.” Bank of Oklahoma “discovered that the card had been swiped at numerous other locations just prior to confirmed attacks,” the Secret Service agent wrote.
The Jan. 23 jackpotting incident netted the bandits $22,400, records reflect.
Shortly before noon on April 14, 2022, TransFund was notified that the “1421” card had been swiped at a convenience store in Del City. Surveillance footage showed two of the four defendants entering the store, proceeding directly to the ATM and swiping a card, but leaving the store without completing an attack, the agent said.
Approximately three hours later the task force was notified of another potential jackpotting attack in progress at the convenience store in northwest Oklahoma City. Chevalier Martinez was seen sitting across the street from the convenience store, “acting as a lookout.”
TransFund confirmed the ATM went offline at approximately 3 p.m. and service was restored an hour and a half later. While the task force team was in place, the convenience store provided surveillance photos of the subjects at the ATM at the time of the jackpotting attack.
Among the surveillance photos was one of Chevalier Martinez and Edgar Johan Ravelo approaching the ATM at 2:59 p.m., “which is the time that TransFund confirmed the card ending in ‘1421’ was first swiped at that ATM,” the Secret Service agent wrote in his affidavit.
Surveillance photos also showed Clever Medina-Martinez entering the store while wearing a blue shirt and a red wig and carrying a keyboard. He also was photographed standing in front of the ATM with the top portion of the machine open, the agent wrote.
All four men were arrested at the scene, court records indicate.
During a search of Chevalier Martinez, task force officers found the card ending in the numbers ‘1421’ plus several hundred dollars in cash “inside his back pocket,” the Secret Service agent reported. During an inventory of the car, officers recovered “a fanny pack full of tools, a laptop computer, a small pocket-sized keyboard, several hats, articles of outerwear,” a red wig and a blue shirt.
Clever Medina-Martinez admitted wearing the disguise into the store and opening the ATM machine, the agent wrote. Medina-Martinez also told the officer “he has known the other three suspects … since he lived in Venezuela years ago.”
Chevalier Martinez, Wilfredo Lezama-Garcia and Clever Medina-Martinez were credited for time served in detention after their arrest, but were ordered to pay the bank $22,400 in restitution, individually or collectively.
Although Edgar Ravelo, 45, was indicted with the other three, prosecutors later dismissed the charge against him because it could not be proven conclusively that he participated in the thefts.