OKLAHOMA CITY – Three men from Washington state indicted in federal court here were members of a transnational Romanian crime ring arrested across the nation over the past two years on fraud charges arising from use of credit and debit card “skimming” devices.
Valentin Cristian Alexandru, 35, who has at least one alias; Sebastian Bulacu, 36; and Florin Radu, 42, who has at least three aliases, were indicted in Oklahoma City’s Western District federal court on 11 counts of bank fraud alleged to have occurred during an eight-day period this year: Jan. 6-14.
Skimming is identity theft by misuse of debit cards, primarily but not solely, to steal Supplemental Nutritional Assistance Program benefits (SNAP, formerly known as food stamps). Thieves install hidden electronics into automated teller machines to steal the account information stored on debit cards, and to record the personal identification numbers required to access the card holder’s account.
In order to work, skimming generally requires use of specialized equipment, which usually consists of two separate components.
The first component is the “skimmer” itself, which is either a card reader placed over the ATM’s actual card slot or a deep insert skimmer embedded into the card slot itself. When victims slide their cards into the ATM, they unwittingly slide them through the counterfeit reader, which scans and transfers all information from the magnetic strip of the genuine debit card onto a digital memory chip on the skimmer.
The second component is a covert video camera that is pointed at the keypad and records the victims entering their personal identification numbers.
While some skimming equipment transmits the data wirelessly over Bluetooth or cellular data connections, most skimmers and cameras generally store the data on the devices themselves, requiring the thieves to return to the ATMs and retrieve the skimmers and cameras to get the data they have captured.
After retrieval, thieves download the account information and transfer – “re-encode” – the data onto blank swipe cards. Thieves then use cloned swipe cards to withdraw cash from victims’ accounts at ATMs by using the corresponding PINs.
Skimming victims often are unaware of the theft until they receive a billing statement or overdraft notice in the mail.
Financial institutions in the Oklahoma City metro area that allegedly were targeted by the three Romanian nationals were Bank of America and Arvest Bank.
Oklahoma City police and federal investigators allege that:
• Bulacu installed skimming equipment on two BoA ATMs on Jan. 10, and later that day he and Radu attempted to remove the devices.
• On Jan. 13 Bulacu and Radu withdrew “and attempted to withdraw” $680 from an Arvest ATM in Oklahoma City, using at least three counterfeit debit cards re-encoded with stolen bank account information.
• Radu and Bulacu also withdrew and attempted to withdraw $400 from an Arvest ATM in Moore, using at least two fake debit cards, on Jan. 13.
• That same day, Bulacu and Radu used fake cards to withdraw $300 from three BoA accounts, and attempted to withdraw $580 from two other BoA accounts, prosecutors allege.
• Bulacu installed skimming equipment at a BoA ATM in Yukon and two in Oklahoma City on Jan. 14.
• Alexandru withdrew and attempted to withdraw $1,500 Jan. 14 from an Arvest ATM in Oklahoma City, using at least six counterfeit debit cards.
• Also on Jan. 14, Alexandru withdrew $200 from two BoA accounts and attempted to withdraw $100 from each of three other BoA accounts, using counterfeit debit cards.
The three Romanians apparently were arrested on Jan. 14. Records show that cameras caught the suspects installing skimmers and leaving in a rental car that had visible plates. That helped Oklahoma City police track down the suspects.
At an Airbnb in which the Romanians were staying, Oklahoma City Police Department said officers found 94 counterfeit debit cards, 36 deep-insert skimmers, false identification cards, and 57 pinhole cameras.
Oklahoma City Police Captain Valerie Littlejohn said more than 100 victims were affected.
The three Romanians were indicted Sept. 2 on 10 counts of bank fraud and one count of conspiracy to commit bank fraud. All three are scheduled to appear in court on Sept. 18.
Bulacu and Radu have been incarcerated in the Oklahoma County Jail since Jan. 14. A court document showed that Alexandru also was lodged in the county jail on Sept. 2, but his name did not appear during an inmate search on Sept. 4.
Skimming detected in Okla. City in 2024 and Virginia in ’23 In March 2024, Oklahoma City police and the U.S. Secret Service revealed an investigation into a multistate credit card skimming operation.
According to an Oklahoma City television station, court documents revealed how investigators caught on to the Romanian nationals accused of targeting people in the Oklahoma City metro.
The documents reported that a group of scammers inserted credit card skimming devices at local ATMs in November 2023. The same people suspected in that crime were arrested in Indiana on the same charges.
According to Oklahoma City police, a metro bank identified fraud on several accounts in late November 2023 and traced the transactions back to skimming devices that had been installed the week before.
An investigator said more than $17,000 was taken before the fraud was discovered. Most of the victims had less than $1,000 each taken from their accounts, investigators said.
In Virginia, a Romanian national was sentenced in June 2024 to one year and six months in prison for using card skimmers to steal credit and debit card information and defraud banks.
According to court documents, from September 2022 through August 2023, Cristian Romica Ristea, 52, stole credit and debit card information across the East Coast of the United States.
Ristea installed and maintained skimmers in ATMs and installed pinhole cameras to obtain PIN numbers.
In August 2023 law enforcement officers observed Ristea conduct an illegal transaction at a BoA ATM in Chesapeake. Afterward the officers arrested Ristea and conducted a search of his vehicle, in which they found 36 vanilla Visa cards, skimming tools, a skimming device, and an international driver license in the name of “Christan Weber.”
Law enforcement officers then searched the home Ristea was renting and found additional skimming tools and skimming devices. Ristea was in possession of 91 vanilla gift cards that were encoded with stolen information. One financial institution estimated that 289 card numbers were compromised.
3 arrested in Ohio for food stamp theft In May, a nearly year-long investigation into the use of card skimmers to steal more than half a million dollars’ worth of SNAP benefits across Ohio resulted in indictments against two Romanian nationals and a Hispanic man.
A Franklin County Common Pleas Court grand jury returned charges against Columbus residents Ionut Bizga, 33; Doina Bacelan, 32; and Juan Hernandez, 26. Each was indicted for a pattern of corrupt activity and food stamp fraud.
The indictment alleges that since July 2024, the trio stole at least $600,000 in benefits to buy thousands of dollars’ worth of “junk” food.
The suspects are accused of purchasing bulk quantities of candy and energy drinks with stolen EBT benefits and gift cards, often exceeding $3,000 per visit. The items were kept in storage units around Columbus, Ohio, then shipped out of state in box trucks and, on several occasions, sold to a local distributor. These suspects and several unidentified individuals were also observed installing credit card skimmers at stores in Ohio and Kentucky.
On May 15, Ohio Investigative Unit agents searched three vehicles, one residence, and five storage units at three locations. Items seized included:
• Public Storage site: 32 cases of energy drinks.
• A+ Storage: 232 cases of energy drinks and 205 cases of candy.
• A Kia Sedona: 125 cases of candy and seven cases of energy drinks.
• A Volkswagen Jetta: two laptops, six credit card skimmers, a credit card terminal, and 18 suspected cloned gift cards.
• A Honda Odyssey: various records and criminal tools.
• A house in Columbus: two laptops, two cell phones, 36 suspected cloned gift or credit cards, and a magnetic card reader/writer believed to be used to create cloned EBT cards.
7 Romanians charged in California EBT thefts Five Romanian nationals were arrested in Bakersfield, California, on charges arising from a scheme involving stolen Electronic Benefit Transfer funds.
Bogdan Boceanu was arrested in July 2024 while trying to place a skimmer in a Bank of America ATM. After posting bail, he was arrested again at a Wells Fargo bank in another town on an outstanding warrant; law enforcement officers said he was in possession of 36 cloned EBT cards and more than $4,000 in stolen cash at the time.
Boceanu pleaded no contest to grand theft of access cards and vandalism. Nine other charges — including burglary, grand theft, and attempted money laundering — were dismissed as part of a plea deal.
He was sentenced May 30 to 16 months in prison; since he had already spent 352 days in custody, he is expected to be released later this year. Court records indicate Boceanu also will be required to make restitution to his victims.
Alberto-Ionel Baran was sentenced in June to two years in prison. When arrested, Baran had 175 EBT fraudulent cards that had more than $121,000 in stolen benefits, records reflect.
Three other Romanians accused of EBT theft – Norbert Karaba, Giorgio Marcelo, and Nicolae Bud – are wending their way through Kern County’s court system. Two other Romanian nationals, Mari-Mar Milica and Fernando Stantu, reportedly are still being sought for arrest in the seven-member Romanian crime ring.
In a related matter, California police issued warnings last year of debit card skimming devices deployed at Walmart stores. Dozens of people became victims of identity theft and debit card fraud after Romanian mobsters placed skimmer devices at grocery store self-checkout machines.
Romanian Andrei Bogdan Arteni appeared in federal court in Los Angeles on Sept. 6, 2024, to face charges in the Southern District of California that he conspired to steal hundreds of thousands of dollars in public-assistance benefits from low-income families that need the funds to pay for food, housing and other necessities.
Arteni was arrested in connection with thefts which resulted in losses exceeding $580,000, prosecutors alleged. According to the complaint, between October 2023 and March 2024, Arteni and co-conspirators installed skimming devices at pointof- sale terminals in grocery stores and large-volume retailers in communities with higher concentrations of public benefit recipients.
4 Romanians steal from Houston banks A man and woman living illegally in Houston admitted their roles in installing and removing ATM skimmers from machines at multiple banks in the Houston area.
Perla Miclescu, 26, and Rafael Rafaila, 21, both citizens of Romania, each entered guilty pleas in May to conspiracy to commit bank fraud.
In April 2024 they installed skimmers at ATM terminals.
The first instance involved co-conspirators. Security footage at a Houston bank showed Ana Maria Dirman, 30, and Mihai Alexandru Gaita, 38, both Romanian citizens, placing an ATM skimmer into the card reader. At the time, they were in a 2004 Ford Explorer.
An investigation revealed the vehicle was at two other banks in the Baytown area approximately two weeks later. ATMs at both locations were found to have deep-insert skimmer and pinhole camera devices placed on them.
Law enforcement officers eventually discovered Miclescu and Rafaila in the same 2004 Explorer. They conducted a search and found two overlay pinhole camera devices and supplies used to make the overlay cameras, 24 re-encoded counterfeit credit cards, and one deep-insert skimmer.
Miclescu and Rafaila also operated a gold-colored minivan April 5 and 7, 2024, placing a skimming device in other ATMs.
Gaita, too, previously pleaded guilty, and Dirman remains a fugitive.