The Rise and Crimes of a Romanian ATM Skimming Riviera Maya Gang

The story of the Riviera Maya Gang, a group of young people from a small town in Romania who built an ATM business and expanded it internationally, is a fascinating tale of both entrepreneurship and criminality. They started with a small business and used their profits to buy new equipment and hire skilled workers. This helped them grow their business around the world.

However, the group's success was built on illegal activities—they were skimmers, stealing bank card information by inserting illegal devices or software into ATMs. As their business grew, so did the extent of their crimes.

According to police and former members of the gang, they are one of the largest criminal skimming groups in the world, controlling close to 10 percent of a $2 billion global market. This article will talk about the rise and crimes of a Romanian gang from Craiova city that stole money from ATMs. It will describe how they worked internationally and how the police are still looking into their illegal activities.

The Craiova city group, a group of young people from a small town in Romania, built an ATM business and expanded internationally. They invested their profits in new technologies and skilled labor, hired smart engineers from the growing Romanian technology sector, and signed an agreement with a local bank.

However, their business was not legal and they were skimmers, people who steal bank card information by inserting illegal devices or software into ATMs. Their leader was nicknamed El Tiburón (The Shark), and the bigger their business got, the more crimes they had to commit to keep it growing. According to police and former members of the gang, they are one of the largest criminal skimming groups in the world, controlling close to 10 percent of a $2 billion global market.

OCCRP and its partners Mexicans Against Corruption and Impunity and Quinto Elemento Lab reviewed thousands of documents, interviewed people on three continents, scoured social networks, and pieced together a jigsaw puzzle of transnational crime. Despite being caught on more than one occasion, the gang has continued to operate around the world, with no end in sight.

Tourist Falls Victim to ATM Scam in Playa del Carmen

Rod W. and his family were on vacation in Playa del Carmen, Mexico, the tourist epicenter of the Riviera Maya. One sunny day, Rod wanted to buy a cigar, so he left the restaurant to withdraw cash at one of the many ATMs in the area. In just 15 minutes, thieves withdrew more than $800 from his account. Rod had been careful to recognize a doctored ATM, but this machine had no apparent skimmer, with a flashing light above the card slot.

He couldn't have known that the software, installed in the ATM, was doing the skimming. Rod, who asked that his last name not be published, was not the only one to lose his money since 2012 when a group of Romanian-led criminals turned Cancun into their base of operations. These tourists had their bank card numbers stolen and then copied onto a blank plastic card, which was then taken out of a bank in another part of the world.

Florian Tudor, Alleged Leader of Riviera Maya Gang

Florian Tudor is a businessman and the leader of the Riviera Maya gang in Craiova, Romania. Romanian police are investigating him for running an organized crime group, incitement to racketeering, one count of racketeering, and one more count of incitement to murder. Mexican police are also targeting him.

Romanian prosecutors allege that Tudor ordered Tudor to threaten, beat, blackmail, and murder enemies of the gang, including former members with whom he quarreled. Tudor denies these allegations, claiming he is a legal businessman and a victim of corrupt Romanian and Mexican authorities bribed by criminals. He also accuses OCCRP reporters of being allies of these corrupt authorities.

The Story of a Romanian ATM Skimming Ring in Mexico

Adrian Tiugan, a Romanian from Craiova, joined El Tiburon in Mexico in December 2013 to create Top Life Servicios, a trading company that would become the pillar of Tudor's business empire. To prove his identity, Tiugan used a Mexican residency permit and a forged Romanian temporary passport, which was valid for five years.

Despite the fake passport and Romania issuing an international warrant for his arrest, Tudor refuted the fact, arguing that he, his brother, and associates do not use fake identities because "we have nothing to hide." The gang's skimmers and collectors operated as far afield as Indonesia, India, Barbados, Grenada, Paraguay, Brazil, Japan, South Korea, and Taiwan, making it difficult for victims to link the robberies to their Mexican vacations.

When Tudor moved to Cancun, some members of his family followed him, including his stepbrother, Adrian Enachescu, 33, and Ion Damian Nedescu, 49, a businessman and philanthropist from Constanțza. Nedescu was known in Romania for his inspirational story of the efforts he made to help his son and other children with autism.

In February 2014, Nedescu took a 20 percent stake in Top Life and became a representative of the company. Tudor's team began to install skimmers in other people's ATMs, but they realized that the scams could be even more effective if they owned their machines. Court records show that the gang began buying Chinese ATMs, including Triton and Hyosung, and installing their software, custom-designed to capture bank card data.

Operating a Multi-Million Dollar Skimming Scheme

Enachescu and Nedescu became involved with other companies run by the gang, including Intaller, which bought and sold new and used ATMs. In 2014, they struck a deal with Multiva, a respected Mexican bank, to install Multiva-branded ATMs in the Riviera Maya and other tourist sites in Mexico.

By 2017, Top Life Servicios had 100 ATMs with chips installed in them, copying around 1,000 cards every month and withdrawing about $200 from each of these cards. They ended up generating revenues of 240 million dollars annually, tax-free. The Riviera Maya gang was the operator of one of the world's largest skimming operations, with about 10% of the global total handled by its members.

It grew to 1,000 members, with a core of about 50 people close to Florian Tudor. Enachescu, Tudor's half-brother, created Investcun Real Estate in 2015, which invested millions from the group in properties in Mexico. El Tiburon was a shareholder of Intacarrent and Brazil Money Exchange and had power of attorney over Inmobiliaria Investcun.

Nedescu, who has no known criminal record, welcomed recruits to Cancun, generally, Romanian technical experts hired by the gang. Tudor did not answer specific questions about the allegations of criminal activity, saying only that he was not a criminal and that he was being pursued by Romanian prosecutors and Mexican police. OCCRP tried to contact other gang members, but they did not respond.

Riviera Maya Gang's ATM Skimming Operation Exposed

The Riviera Maya gang began to run into problems in 2015 when U.S. journalist Brian Krebs published a story about its business. Krebs was tipped off that the gang was using Bluetooth and skimming devices made by Cristian Simion, a Romanian technician hired to work for the gang.

Krebs took a plane and flew to Mexico, where he found ATMs in Cancun, Playa del Carmen, and even Cancun International Airport that issued a Bluetooth link called free2move. Back in the United States, Krebs blogged the story about skimming with the Bluetooth system in Mexico. When Tudor learned of the story, he contacted Constantin Sorinel Marcu, one of his men, via Viber and ordered him to shut down all operations.

Simion, the technician who was a member of the gang, is now a protected witness and later explained to Romanian prosecutors that El Tiburon summoned the gang members to the company's headquarters and told them to temporarily remove the chips from about 10 of the 25 to 30 ATMs that belonged to other banks or companies.

Uncovering the Troubled Relations and Operations

Krebs' investigation revealed that El Tiburon was expanding its ATM network in Mexico thanks to its agreement with Multiva. However, a much bigger problem was brewing, one that would provoke a feud between the gang and the Mexican police. This feud was caused by Marcu, a fugitive from Romanian justice who arrived in Mexico in 2014 to work with El Tiburon.

He had an international arrest warrant, but Mexican authorities never bothered him. Marcu was in charge of ensuring the security of Top Life's ATMs, especially in Playa del Carmen, where millions of tourists enjoy its bars, restaurants, and nightclubs. In Romania, El Tiburon and Marcu had a very close relationship, with Tudor envious of Marcu's success with women and Marcu unhappy with the share of the skimming business he was receiving.

A Look at the Feud Between Marcu, Tudor, and El Tiburon

A series of cell phone screenshots obtained from criminal files show Marcu and Tudor exchanging insults in May 2015. Tudor sent Marcu a WhatsApp video of him sabotaging gang ATMs, smearing glue on the card reader, to render it unusable. Marcu complained because he provided the force that allowed him to eliminate El Tiburon's enemies and competition.

El Tiburon instructed the gang members to cut relations with Marcu, and on April 2, 2018, four thugs attacked Marcu, in front of a DHL office in Cancun. Marcu later had his spleen removed at a local hospital, and El Tiburon and the four attackers were charged with attempted murder.

Two months later, on June 11, he was shot in the head, and a Mexican security agent was arrested for the murder. The murder sparked a war with Marcu's family and allies, but also with factions of the local Mexican police.

The Controversial Accusations, Arrests, and Legal Battles

In May 2019, Mexican authorities conducted separate entries and searches at Top Life's headquarters and Tudor's home in Cancun. Tudor and five of his collaborators were arrested, and the real purpose of the police operation was to steal $2.7 million worth of jewelry, art, cash, and computer equipment. Tudor launched a legal battle in the months following the searches, filing a petition for constitutional protection and a corruption complaint against officials involved in the operation.

In February 2020, Tudor and two of his collaborators published a two-page open letter in a Mexican newspaper against the Quintana Roo state security secretary, Jesús Alberto Capella Ibarra, accusing him of extorting them, violating their human rights and causing them psychological, physical, emotional and economic damage. On March 16, El Tiburon held a press conference at his Cancun home in which he insisted that he is a law-abiding businessman who had become the target of unscrupulous police, journalists, and criminals.

He claimed that Marcu and his people tried to extort and blackmail him and that Marcu threatened him with death after he refused to involve his legal business in a cloned card scheme. He said Krebs' story was the beginning of a "smear campaign" that destroyed years of hard work and led to him losing his contract with Multiva. Tudor alleged that the authorities were in the pay of the Marcu gang, including Capella, who wanted him dead.

He alleged that the police planted guns on him to justify their arrests, and threatened to rape his wife and leave his son an orphan. Capella, the police chief, responded to those attacks on Twitter, denouncing "a perverse media campaign orchestrated and financed by dark interests." The Quintana Roo Public Security Secretariat claimed that Tudor's allegations against Capella were primarily an attempt to obstruct ongoing investigations against him and his organization.

In Romania, five of El Tiburon's main collaborators were arrested and Tudor himself is under investigation for the attempted murder of his former friend Marcu. Marcu is buried in Craiova's central cemetery, where his parents come almost every day with flowers and candles and sit by his grave. His father sold two cars to raise the money needed to buy the burial plot and a black marble headstone, where he placed a photo of Marcu and an epitaph: "For you and the life that was torn from me, think of me from time to time."

How Ion Damian Nedescu's Business Ventures and Advocacy for Autism Collided with Organized Crime

El Tiburon's financial structure has several members from Craiova with a history of run-ins with the law. However, one of the significant players, Ion Damian Nedescu, 49, is a philanthropist from Constanta with no criminal record who is an advocate for children with autism. In 2014, Nedescu faced financial troubles, having failed to repay some loans and losing one of his properties in Bucharest.

That same year, he became a minority partner of the Riviera Maya gang's primary company, Top Life Servicios, and in 2015, he created NID Export Import Trading LLC, sending money from US bank accounts to members of the criminal organization in Mexico and Romania. While working for the criminal group, Nedescu put Top Life Servicios ATMs in the Riviera Maya and helped set up several websites.

The reason for Nedescu's involvement in the gang's activities remains unclear. One witness claimed that El Tiburon needed Nedescu because he was intelligent, spoke good English, and was a prepared businessman. Another witness reported that Nedescu's girlfriend helped him get blank bank cards and advised him on how to handle EMV cards.

Despite his involvement in criminal activities, Nedescu was also leading a double life. In 2004, after his son Radu was diagnosed with severe autism, Nedescu rejected the doctor's diagnosis and sought Applied Behavioural Analysis (ABA) therapy, eventually founding the Horia Motoi Foundation with his wife.

The foundation trained psychologists, developed toolkits, and worked on changing the perception of autism. After a year of therapy, Radu made significant progress, graduated from school, and is now a philosophy student in Belgium. Nedescu shared his experience on his Facebook page, which he created in 2018, but did not disclose his involvement in criminal activities.

A Romanian Technician's Encounter with Mexico's ATM Skimming Gang

Cristian Simion, 44, is a Romanian radio transmission technician who found an ad on the internet offering a good salary in Germany for people familiar with Bluetooth and other wireless transmission technologies. He was recruited from Romania's fast-growing technology industry and flew to Mexico, where he met Cosmin Adrian Nicolae, 38, a top-level member of the gang. Nicolae gave Simion some money to send to his family in Romania and told him to relax and try to get used to life in Mexico.

Simion told Romanian prosecutors that he met Florian Tudor a couple of weeks after arriving in Cancun and was taken to a mansion in Novo Cancun, a posh beachside neighborhood in the city. There he was met by Tudor and several of his associates and insisted that he snort cocaine while members of the group evaluated him and voted on whether or not he deserved to join their ranks.

Simion worked with El Tiburon, Nicolae, and others in the gang, installing skimming devices and ATM software. In 2017, he wanted to leave and found work in a Mexican advertising company, but his decision was not well received by El Tiburon. One night in January 2017, Tudor summoned Simion to a reserved room in a Romanian restaurant in Cancun and began beating him with a hose.

He continued to beat him the next day at the offices of Top Life Servicios, and Simion left Mexico, flying first to Germany and then to Bucharest, the capital of Romania. Simion fled to Mexico, but El Tiburon's people tracked him down and he received threats from Tudor himself via the Viber app.

Tudor mentioned that he had contacts with Mexican security forces and threatened to open a criminal case against him and issue an international arrest warrant. Simion agreed to return to Cancun and work for the gang for another month, but the next day, two of El Tiburon's thugs came to his house and threatened him.

Simion tried to contact El Tiburon, but he was not answering his calls. El Tiburon called him two days later and told him that one of his lieutenants had forgotten to tell the thugs not to bother him anymore and that they already had an agreement. Simion refused to return to Mexico and is now a protected witness against Tudor and his gang.

The Story of Sorin Velcu and the Riviera Maya Gang

Sorin Velcu, a native of Craiova (Romania), is accused of belonging to a criminal organization for his affiliation with the Riviera Maya gang. He was one of the gang's top collectors, sending around the world to withdraw cash at ATMs with cloned cards. He also set up skimming devices at ATMs in different countries, to obtain new bank details.

The Romanian police obtained an account book where batches of hundreds of credit and debit cards, passwords, as well as names and nationalities of the banks that issued the cards, were recorded. Velcu is a muscular, tattooed guy with a neatly shaved beard, and used to drive a Chevrolet Camaro around Craiova, despite not having a license. He has been arrested in the Caribbean nation of Grenada, on the Indonesian island of Bali, and upon his return to Romania, he is awaiting trial.

In February 2020, two members of the gang were arrested in Barbados for withdrawing money with cloned cards and installing skimming devices. Maria Dumitru, 32, was carrying money from Barbados worth $40,000, which she had not declared to customs. Despite being arrested, they rarely faced harsh punishment. Western Union receipts show that the gang mobilized to save their people, sending 25,000 Barbados dollars to lawyers in Barbados to pay the fines for the two men. A few days after the arrests, another of the gang's collectors was arrested at Cancun airport on a flight from Panama. Velcu and Dumitru are brothers.

How They Used Western Union and Moneygram to Launder Cash

The Riviera Maya gang used services such as Western Union and Moneygram to launder their cash or to assist their people in distress. Eduardo Costel, 29, was working on the construction of a house when Rebeca Tudor, El Tiburon's wife, approached him and his 10 companions with a request to receive some money sent by her husband from Mexico.

Each of them received a piece of paper with funds transfer codes (MTCN). The money arrived via Western Union not only from Mexico but also from the United States and other countries. Workers, students, makeup artists, the unemployed, and even priests were asked to withdraw money from Western Union for the gang.

Viorel Ciortan, 47, an Orthodox priest who was employed by the gang, sent money to several countries for the benefit of the criminals. This was only part of the money laundering operation and the gang continued to send money hidden in picture frames, and DHL packages, hiding it in cars they exported from one place to another or simply crossing borders with large amounts of money.

Sources:

Full Citation: “La Banda De La Riviera Maya: Bandidos Globales De Los Cajeros.” Aristegui Noticias, aristeguinoticias.com/2705/investigaciones-especiales/la-banda-de-la-riviera-maya-bandidos-globales-de-los-cajeros.