The bulk purchases of Red Bull and Monster Energy drinks were huge. Within about two months late last year, the same small group had spent roughly $305,270 buying pallets of the caffeinated drinks at grocery stores in downtown San Diego and Riverside.
The transactions were large enough that members of the group had to make special arrangements with store managers ahead of time and pick up the drinks in the Smart & Final loading docks. They presumably resold the drinks at a profit — and the profit would be huge, since the money didn’t even come out of their own pockets.
Instead, the purchases were made with money pilfered from low-income public benefits recipients.
Last week, a member of the group pleaded guilty in San Diego federal court to one count related to the scheme. Beatrice Mihai, a 25-year-old Romanian citizen who lived in Anaheim, admitted in her plea agreement that her and her co-conspirators stole and misused the Electronic Benefit Transfer funds intended for nearly 175 victims in California, New York, Florida and Rhode Island.
The energy drink plot was just one piece of a larger system of thefts and frauds operated by Romanian organized crime groups that have recently hit Southern California particularly hard. Dating back at least a decade and a half, Romanian crime rings spread across the world have installed card skimmers on ATMs and card readers inside businesses, giving them the ability to clone the debit and credit cards of unwitting victims who swipe their banking cards.
More recently, Romanian organized crime groups have plundered taxpayer funded programs for low-income Californians, targeting those swiping state-issued cards loaded with EBT and unemployment benefits. Investigators believe those accounts are being specifically targeted because the state-issued benefit cards are more vulnerable, since they lack the chips embedded on most bank-issued debit and credit cards.
The theft has become a huge problem.
In the six months between last August and January, thieves using compromised EBT accounts stole close to $39 million from benefit recipients across California, according to recently unsealed federal search warrants citing figures provided by the California Department of Social Services. About $2.3 million of that total was stolen from ATMs in San Diego County, and about $2.9 million was stolen from San Diego County residents.
The Los Angeles Times recently reported that the statewide loss from such thefts spiked from just $3.2 million in the last six months of 2021 to $51.9 million for all of 2022. That figure jumped again to $31.6 million in the first three months of this year — setting a pace for $126.4 million for the entirety of 2023.
Law enforcement authorities believe Romanian organized crime groups are responsible for most of that loss.
To battle the huge losses in recent months, federal authorities — including the FBI, the Secret Service and U.S. attorney’s offices in San Diego and Los Angeles — have arrested or indicted dozens of suspected members of Romanian organized crime groups. The exact relationships and connections between the various suspects and defendants is not always clear, with some appearing to be part of well-organized cells, and others appearing to have looser associations. Investigators wrote in search warrants that the crimes were committed by “what appear to be one or more criminal enterprises.”
Romanian card skimming
Like Mexican drug cartels or Nigerian romance scammers, Romanian organized crime groups have found a niche skimming ATMs and in-store card readers. This dates back to at least 2009, but likely long before that, when Romanian police busted a group that had reportedly been stealing debit and credit card information in Italy, Switzerland, France and the U.S.
In 2020, the Organized Crime and Corruption Reporting Project published a wide-ranging investigation into a longtime Mexico-based Romanian group it dubbed the Riviera Maya gang, which apparently stole hundreds of millions of dollars through a card-skimming operation based in Cancún and is believed to still be active. The scheme targets the millions of tourists who visit the region each year as they pull cash from their accounts.
On a near-weekly basis, news reports from across the U.S. — citing police records, prosecutors, court evidence and news releases — demonstrate the links between Romanian groups and ATM skimming operations.
Such groups based in California have ramped up their targeting of EBT and unemployment cards as of last year.
Though it may seem to victims like they’ve been hacked virtually, since their accounts are drained almost as soon as the state deposits their benefits, the perpetrators of the crimes have to physically install the card skimmers, usually known as an overlay skimmer. They do this by installing a counterfeit face plate over the top of a legitimate card reader. When victims swipe their cards, the information is read by both the legitimate card reader and the skimmer, which stores the information.
The skimmed data is then re-encoded onto “cloned” cards the thieves can then use to manually withdraw money from an ATM. Or they can spend the funds at a store, like Mihai and the others who purchased the energy drinks.
That gives investigators two opportunities to intercept the bandits, with the easiest option being to catch them making unauthorized withdrawals at ATMs. These typically happen the first few days of a month, when the state usually disperses food stamps and unemployment assistance.
Cash and cloned cards seized as part of a September law enforcement operation targeting ATM thieves. Law enforcement said they made 16 arrests in around 15 minutes.
(Los Angeles County District Attorney’s Office)
That’s what happened last month, when federal investigators staked out several ATMs across San Diego County on the first two mornings of June. They arrested five men — four of them Romanian — during the operation. It was unclear if the fifth man was linked to the Romanian groups, but all five are facing federal charges and have pleaded not guilty.
Local and federal authorities in Los Angeles County have made dozens of arrests, including that of a city councilman from one Romanian town, during similar ATM surveillance operations this year.
San Diego skimmers
According to federal investigators, skimmers targeting EBT cards were discovered last year at three Walmart stores in San Diego and the South Bay. According to search warrants and other court documents, the Romanian crime groups began operating in San Diego at least as early as March 2022.
In June of last year, a 26-year-old Romanian man from Los Angeles was allegedly caught installing a card skimmer at a National City Walmart, according to search warrants. The man initially presented police with false identification, the records say, and an alleged accomplice got away without being caught. But once National City police officers learned the arrested suspect’s true name, they discovered he was a Romanian national in the U.S. without documentation.
They arrested him on suspicion of four charges related to theft, conspiracy and using a scanning device, according to the search warrants. A few weeks later, in July of last year, employees at a Chula Vista Walmart discovered a card skimmer at the store. When authorities reviewed surveillance footage, they saw the National City suspect and an accomplice had installed the device two days before being caught in National City, according to investigators.
Additional investigation revealed that the same National City suspect was believed to be responsible for installing an overlay card skimmer months before, in March, at the Walmart Neighborhood Market on Imperial Avenue in Logan Heights, according to the search warrants. He was accompanied by two alleged accomplices during that installation.
A spokesperson for the San Diego County District Attorney’s Office said prosecutors did not file charges against the man in connection with his June 2022 arrest in National City.
“We can only file charges when we believe we can prove them beyond a reasonable doubt,” the spokesperson wrote in a statement. It’s unclear when prosecutors decided not to charge the man and if they knew at the time of that decision about his alleged involvement installing the additional skimmers at the Chula Vista and Logan Heights stores. It’s unknown if he might face federal charges.
ATM withdrawals
On Sept. 1, after authorities learned most unauthorized withdrawals happened early each month, investigators with the Southern California Cyber Fraud Task Force staked out three San Diego ATMs that had previously been used to drain victims’ EBT accounts. They arrested two suspects as they allegedly made such withdrawals.
Both men presented the task force investigators with fake IDs from other European countries, and they were initially arrested under those names. Investigators later learned their true names and discovered they were “Romanian citizens who lacked legal status to be in the United States,” the investigators wrote in a warrant. They were believed to be Los Angeles residents.
County prosecutors filed state charges against the pair, but they were released on bond and promptly disappeared, according to investigators. A spokesperson for the district attorney said federal prosecutors are now handling that case.
Authorities later learned the same two men had allegedly made unauthorized withdrawals at San Diego County ATMs on at least 11 occasions between May and August, pulling out nearly $28,000 on one occasion.
A few months later, investigators learned about the energy drink scheme at the San Diego and Riverside Smart & Final stores. Prosecutors alleged the group made at least 16 bulk purchases between the two locations in October and November, swiping multiple EBT cards to complete each purchase.
In January, the group communicated with a store manager to set up another purchase at the Smart & Final in Riverside. This time investigators were waiting, and they arrested Mihai after she spent more than $4,570 using five different cloned cards.
