It was a muggy day in Cancún in September 2015, and a Romanian gangster nicknamed “The Shark” was in a murderous mood.
Florian Tudor, the then 38-year-old crime boss from Craiova, in southern Romania, had been running a lucrative scam in Mexico’s Mayan Riviera. He was skimming money from tourists using cash machines fitted with devices to copy their ATM card details.
But an American journalist, Brian Krebs, had posted an article and video on his website exposing the operation.
“They destroyed us. That’s it. Fuck his mother. Close everything,” Tudor told his right-hand man Constantin Sorinel Marcu over the messaging app Viber, according to records from Romanian prosecutors. “Tell them that I am going to kill them.”
“Ok, I can kill them, any time, any hour,” replied Marcu.
Tudor’s worries proved unfounded. An OCCRP investigation with media partners in Mexico and Romania shows The Shark was able to continue this illegal business for another three-and-a-half years. One gang member who turned informant said the scam yielded about US$240 million a year from early 2014 until spring 2019 — for an estimated total of around $1.2 billion — when pressure from Mexican authorities forced the gang to either change up their operations or shut them down.
Using around 15,000 pages of law enforcement documents, as well as property records on four continents and interviews with dozens of sources, journalists pieced together the mechanics of the scheme, which involved up to 100 rigged ATMs in tourist hotspots throughout Mexico.
The investigation also exposes how poorly the country’s regulations are enforced. Through a front company, Tudor’s organized crime group established a business relationship with Multiva, a mid-sized Mexican bank, in 2014 and built a network of cash machines legitimized by its branding.
Despite a number of red flags, Multiva didn’t put a stop to the cash-machine scheme. Instead, the bank renewed its ATM operation contract with the front company, Top Life Servicios, in 2018.
Law enforcement did little to stop the scam either. Romanian authorities have been aware of Tudor and his gang since 2012 and issued indictments against several members this year. Despite their warnings, Mexican police have never charged anyone from the gang over the rigged ATMs.
Experts say the case shows why Mexico needs stronger regulations on ATMs, noting that current laws hold banks themselves responsible for investigating security incidents such as tampering.
“There is a legal vacuum,” said Mario Di Costanzo, former president of the National Commission for the Protection and Defense of Users of Financial Services, which he suggested should be tasked with overseeing cash machines.
“No one supervises ATMs. The only way to pay attention to it is when [the bank gets] a complaint from a user of an ATM that didn’t work well,” he said.
Krebs’ 2015 story did get noticed on the Mayan Riviera, however, where many foreign residents and tourists took to social media to say they had suspected something was wrong with the ATMs. One even posted on Facebook about witnessing criminals removing data skimming devices from cash machines in Playa del Carmen.
“I’ve seen people go to the machines and take the skimmers out right in front of people,” the resident wrote. “They don’t care and the police aren’t likely to stop them.”
Automated Robbery
A key step for the gang was incorporating Top Life Servicios, a seemingly legitimate company that installed and operated ATMs, in late 2013. According to the Mexican Public Registry of Commerce, its founders were two Romanians, Emilian Ciupitu and Paul Daniel Ionete, who is named as Top Life’s sole manager and the majority shareholder.
In fact, Ionete was a false identity used by Adrian Tiugan, a veteran of cash-machine scams. In 2012, he was convicted in Romania for being part of an organized crime group that was planting skimming devices in ATMs around Vatican City, in Rome, two years earlier, but fled before he could be imprisoned. With an international warrant out for his arrest, he ended up in Mexico using a passport he bought for approximately $2,000.
But Tiugan’s criminal background did not stop him from moving to Mexico, setting up Top Life, and building a relationship with an established bank. His fraudulent identity documents were enough to fool Mexican immigration authorities, who gave him a temporary work permit nine months after the international arrest warrant was issued.
Tiugan got to work fast. On March 1, 2014, soon after it was founded, Top Life signed a contract with Multiva. The bank is part of a conglomerate run by Olegario Vázquez Aldir, whose family is considered one of the richest in Mexico and who was appointed to the business advisory council of Mexican President Andrés Manuel López Obrador in 2018.
The agreement allowed Top Life to install “ATMs nationwide with the recognition and sponsorship of Banco Multiva," according to a letter addressed “To whom it may concern.”
Multiva was particularly interested in the Riviera Maya section of the Yucatan peninsula’s Caribbean coast, where there was a strong need for ready cash. Millions of tourists flock each year to Cancún, Playa del Carmen, and Tulum, where the ruins of an ancient Mayan walled city overlook a white sand beach and turquoise waters.
“This commercial agreement covered the entire Riviera Maya area, where we had no presence,” Javier Valadez Benítez, director general of Grupo Financiero Multiva, told OCCRP in an interview at Multiva’s headquarters in Mexico City.
“That [was] also one of our interests because, overnight, we had a network of ATMs with the bank’s image positioned in a market where we didn’t have a presence,” he said, adding that the bank never invested in Top Life, or vice versa.
Multiva representatives declined to disclose how lucrative the contract with Top Life Servicios was for the bank.
Targeting tourist destinations proved a savvy move for Tudor’s gang.
The scammers would steal information on victims’ cards as they used the ATMs. Then the gang would imprint it on a new card, which members would use to withdraw funds from locations around the world. Typically, they would make the withdrawals months after stealing the data, which made it hard for victims to connect the theft to their Mexican vacation, let alone the exact ATM.
Another tactic to avoid detection, said one former gang member, was to withdraw only around $200 dollars per card at a time.
Californian Mark Roberts was on a surfing trip in Sayulita with 13 friends in April 2018 when they fell victim to the gang’s scheme. Despite reading warnings on an online travel forum about ATM fraud in the village, he and his friends visited a Multiva machine when they needed cash to pay for a restaurant bill. By the end of the month, several members of their group had discovered simultaneous fraudulent withdrawals from their accounts at ATMs in Orlando, Florida, and Hollywood, California.
They took the cash out “knowing this might be risky,” Roberts told OCCRP. “As it turns out, it was!”
Using Multiva’s branding gave the gang’s machines a veneer of legitimacy that hid the data skimming technology inside. Further clues on how the scheme worked are laid out in a Romanian arrest warrant issued for five members of the gang in July 2019, on charges of setting up an organized crime group, attempted murder, and blackmail.
Cristian Simion, a former technician at Top Life, told prosecutors his job had included designing and installing chips in ATMs specifically built to steal card data. Company documents also reveal he was made a shareholder in RLU Services Mexico, a firm Simion says imported components and equipment to build the chips.
Top Life “installed ATMs in various crowded tourist areas with the agreement of Multiva bank,” he told investigators, according to the arrest warrant. “In those machines, they installed card-cloning devices.”
Multiva’s executives told OCCRP that they were unaware of investigations into Tudor’s organization by authorities in Mexico, Romania, and the U.S., as authorities had never contacted them. They said a standard background check on Top Life’s owners turned up nothing. It is unclear whether they conducted another before renewing their contract with Top Life in 2018.
Loopholes and Lax Enforcement
Top Life’s licenses, obtained through freedom of information requests, provide a partial map of the front company’s network of ATMs, from the lush rainforest of the Yucatan Peninsula to surf spots and resort towns on the Pacific coast.
The gang was able to place machines in hotels and restaurants in Tulum, near the boardwalks and beaches of Puerto Vallarta and nearby Sayulita, and even in the U.S. border city of Tijuana, according to Romanian authorities citing witness testimony.
Tiugan and another Romanian set up the deals to install the compromised cash machines, which they did using his false identity. He continued even after the Romanian press reported in July 2014 that the real Paul Ionete had been arrested as part of a gang that dealt with psychoactive drugs. Ionete was arrested again in 2017.
Reporters also found that Top Life did not comply with local regulations for obtaining ATM licenses and installing ATMs, including failing to supply required documentation. They got away with it because municipal governments did not enforce the rules.
In Puerto Vallarta, for example, Top Life obtained a license to install an ATM at the municipal offices of the city in 2015. When OCCRP enquired which documents Top Life had submitted for this license, the required rental agreement could not be found.
In Riviera Maya municipalities such as Playa del Carmen, Tulum, and Cancún, the gang managed to install ATMs without any permission at all from local governments. The municipal offices did not respond to requests for comment.
Horacio Esquivel Martínez, an economist and former deputy general director at the country’s Ministry of Finance and Public Credit, said local municipalities shouldn’t have the authority to permit ATM installation and operation, as they are particularly vulnerable to organized crime and corruption.
“Imagine how exposed these municipalities are, and see … how organized crime controls many of them,” he said, adding that companies coerce local officials by offering them only a choice between a bribe or a bullet.
“It’s easy to arrive at a town hall and tell the municipal president — silver or lead.”
Companies also take advantage of poor regulation and a lack of vigilance by banks and national regulatory authorities, Esquivel added. In principle, the regulatory body should have greater capacity to monitor ATMs. But in practice, banks do little supervision and their regulators rarely step in.
“It would have to be a problem that became a matter of public policy or national interest, or in the interest of [the regulators], for them to proceed to do something,” he said.
Multiva’s directors told OCCRP that the bank fulfilled all its obligations and was not aware of any manipulation or alteration of their branded machines. They said the bank had received complaints about some transactions that users did not recognize, but that was “normal.”
They refused to give more details when reporters asked about the number of complaints received from users of Top Life cash machines, but said they monitored the machines remotely through usage reports.
“I don’t have a person beside each ATM watching who enters and who leaves,” said Valadez.
Red Flags
Even if Multiva hadn’t monitored its cash machines in person, it could have taken note of the attention Tudor’s scam received in the wake of Krebs’ investigation.
The story was shared widely, even landing in The Daily Mail, one of the world’s most-read English-language news sites. Krebs said he contacted several departments at Multiva for comment, but only one person replied — and even then only to say he had followed the journalist’s blog for over a decade. “I responded to him twice after that in Spanish but got no further replies,” Krebs said in an interview.
Bank executives insisted to OCCRP that they were unaware of Krebs’ stories and did not know Intacash, which was another name for Top Life. Multiva also said it audited the machines that were set up by Top Life.
In fact, Top Life and Multiva continued working together, even renewing the contract three years after Krebs’ story. Multiva’s Valadez said the bank had no idea who Tudor was or his relationship to Top Life until the Romanian crime boss was arrested March 30, 2019.
Tudor and an associate were stopped at a police checkpoint while driving along a jungle-clad stretch of highway south of Cancún. Officers found a Glock pistol with ammunition that is only allowed to be used by the armed forces, along with more than $25,000 cash in pesos and dollars, according to the Quintana Roo Attorney General’s Office.
Police held the Romanians briefly, and released them after they each paid a $1,000 bail. Tudor’s arrest was covered in local media, and Multiva then broke off its business partnership with Top Life.
“The moment we found out that there was an issue around Top Life Servicios and the name of this man appeared — even though we did not know him — what we did was to finish the said commercial agreement,” said Valadez.
Almost a year later, The Shark was still livid.
On March 16, he held a press conference at his Cancún home, flanked by his lawyer and two associates, to make his case that he was an innocent businessman. Sitting in front of a large gold-framed painting of a cowboy on a horse next to a herd of cattle, Tudor railed against police and journalists, claiming he was the victim of a smear campaign that had ruined his business relationship with Multiva.
“Brian Krebs, like other media, have illegally and falsely assigned the name Florian Tudor to all criminal acts carried out by Romanian people,” he declared. “With this, they are making accusations against me solely on the fact that I’m Romanian.”
Documents from investigations by authorities in Mexico, Romania, and the U.S. tell a different story. According to them, Tudor leads a violent transnational organized crime group, which has not only perpetrated a vast and lucrative international skimming scheme, but also been involved in the attempted murder of a former gang member in Cancún.
In January, Romania’s organized crime investigation agency, DIICOT, indicted six of the gang members for organized crime, attempted murder and blackmail. Three are now in custody and two under house arrest in Romania.
Tudor, however, is still walking free in Mexico.
