The Riviera Maya Gang: Global ATM Bandits

It was a badly needed vacation for Rod W. and his family. Where better to spend it than in the sun and warm sands of Playa del Carmen, a tourist hotspot on Mexico’s Riviera Maya? The resort area has long been a popular destination for Americans, where they can avoid the criminality and violence of the murderous cartels that control much of Mexico.

Or so the family thought.

At the end of a sun-drenched day, Rod wanted a cigar to go with his dinner at a local steakhouse. He left the restaurant to get cash at one of the tourist area’s ubiquitous ATMs.

Within 15 minutes, thieves had extracted over $800 from his bank account. He noticed the withdrawals at once, since he has an automated text alert set up on his phone to notify him of any transaction over $250.

“All of a sudden it was ‘boom,’ ‘boom,’ ‘boom,’ so I think they were at two or three different places, doing it all at once,” Rod said.

He had been careful. He thought he knew how to recognize a compromised ATM. But this machine didn’t have a telltale skimmer blinking over the card slot, and it carried the branding of a respected Mexican bank. He couldn’t have known that the skimming was being done by the software itself.

Rod, who requested that his surname be withheld, wasn’t alone in losing his money. Thousands of tourists have suffered the same fate since 2012, when a group of Romanian-led criminals first made Cancún their home base and began compromising dozens of ATMs around the tourist mecca.

The criminal group, which OCCRP has dubbed the Riviera Maya gang, systematically stole their victims’ card numbers and copied them onto new blank cards, which were given to gang members to withdraw cash from ATMs around the world.

But their story started in a place very different from the sun and blue skies of Mexico.

Enter The Shark

In southwest Romania’s Oltenia region, a rich agricultural heartland just two hours’ drive north of the Bulgarian border, lies the city of Craiova. Once an important medieval center of the Wallachian principality, today it has a population of 300,000, and falling.

As you drive into town, corn and wheat fields give way to shabby, Communist-era housing blocks and derelict factories.

But there is money in Craiova. Closer to the city’s compact downtown, sleek modern luxury apartments begin to appear. Organized crime groups have thrived here, nurtured by endemic local corruption that has largely escaped serious state-level scrutiny.

This is the hometown of Florian Tudor, 43, a businessman and, according to Romanian authorities, the leader of the Riviera Maya group. The gang has about 1,000 members, according to police and a former gang member. Some of the town’s newest buildings are investments from Tudor’s profits from ATM skimming, police say.

Unlike many other members of his gang, who tend to be muscled up, shaved, and tattooed, Tudor has a more discreet presence, with short curly hair and an average build. It’s easy to imagine him blending into a crowd.

His past is murky. He was once allegedly detained in Italy and deported, but the charges are not clear. Romanian authorities seem to have initiated criminal proceedings against him in 2008 and 2009, but they went nowhere. His criminal record in the country, viewed by OCCRP reporters, appears to be clean.

However, as of January 2020, Romanian authorities are investigating Tudor for running an organized crime group. Mexican police are also looking into him.

Romania’s Directorate for Investigating Organized Crime and Terrorism alleges that Tudor ordered his fellow gang members to threaten, beat up, blackmail, and murder the gang’s enemies, including former members who had fallen out with him.

Tudor denies these accusations.

“I am not a criminal and I never will be,” Tudor said in an email exchange with OCCRP. “I have never killed anyone and I have never ordered anyone killed.”

Tudor says he is a legitimate businessman who has been the victim of corrupt authorities in Romania and Mexico who have been bribed by crime figures. He also says he was robbed by the Mexican police, and accused OCCRP reporters of being in league with the same corrupt authorities.

From Craiova to Cancún

It is not clear how the Riviera Maya gang got started, but its beginnings appear to lie in a brisk trade skimming from ATMs developed by a number of people affiliated with Tudor.

Skimmers are devices that can be slipped into an ATM and used to read the magnetic strip on the back of the user's card, while a small camera records the person punching in their PIN. Armed with this information, criminals can duplicate a victim's card on a blank and use it to make purchases or get cash.

Sometime before 2014, Tudor moved to the Mayan Riviera, where he became known as “El Tiburon” — “The Shark.” He was followed by a number of others from Craiova.

One of them was Adrian Tiugan, 36, a small-time hood who went by the alias “Mufa,” or “The Jack.” Before joining The Shark in Mexico, he had worked with a gang planting skimmers in ATMs in Italy and the Vatican. But he was caught and convicted in 2012 by Romanian authorities, who sentenced him to two and a half years in jail.

That didn’t deter Tiugan. After serving a stint in pretrial detention, he was released on a suspended sentence, on the condition that he remain in Craiova and check in with the local police regularly. Instead, he left the country.

In December 2013, Tiugan resurfaced in the offices of the registry of companies in Cancún, Mexico. He was there to set up Top Life Servicios, a commercial enterprise that would be the central pillar of Tudor’s business empire. Its stated business purpose was to service and operate ATMs in Mexico.

He registered the companies using the name of Paul Daniel Ionete, a Romanian from Craiova known to the gang members. To prove that he was Ionete, Tiugan presented a Mexican residency permit and a forged Romanian temporary passport bearing Tiugan’s face and Ionete’s name. The passport lists a validity period of five years, even though Romanian temporary passports are only valid for one year.

There is no evidence Tiugan had any problems with local authorities, despite the fake passport or the outstanding international warrant for his arrest issued by Romanian authorities after he failed to check in with police back in Craiova.

In an email to OCCRP, Tudor shrugged this off, denying that he and his associates had used fake identities. “We have nothing to hide,” he wrote.

Tiugan joined other Romanians connected to The Shark who had been in Cancún since 2012 and possibly earlier. Intercepted phone calls attached to Tiugan’s sentencing records show fellow gang members talking about friends who were arrested for tampering with ATMs in Mexico as far back as 2009.

Cancún, with at least seven million foreign tourists annually — two million more than the Vatican — was the perfect spot for a lucrative skimming operation. Its large, steady stream of visitors, who often stay for days or weeks, ensures an ongoing supply of stolen credit card numbers from banks all over the world. And more cards mean more money.

Cancún started in the 1970s as a purpose-built resort for sun seekers on a flat, 21-kilometer-long island off the Eastern coast of the Yucatán Peninsula. Initially backed by the Mexican government, it was slow to start but has since spread out to cover almost all of the island and large parts of the mainland. It has become the most visited tourist area in Mexico, and a sea of calm in a violent land.

Outside Cancún lies the Riviera Maya, the Caribbean shore that stretches south to the city of Tulum. The Riviera features warm weather year round, turquoise seas, and fine white sand lined by coconut trees. Tourists flock to jungle-encrusted freshwater sinkholes, ancient Mayan temples and pyramids, and natural wildlife sanctuaries, as well as spicy cuisine featuring the region’s characteristic habanero pepper. Throughout the Riviera, high-end resorts are neatly tucked around world-class golf courses and the nights are fuelled by tequila- and mezcal-soaked fiestas.

Targeting tourist areas with skimmers is clever if done right, and the Maya Riviera gang did it right. They would often wait for months before withdrawing money with compromised cards, and they almost always used them in ATMs far from where they were stolen or where the victims lived. The gang’s “skimmers” and “pullers” operated as far away as Indonesia, India, Barbados, Grenada, Paraguay, Brazil, Japan, South Korea and Taiwan.

This made it hard for victims to connect the thefts to their Mexican holiday. Even if they did, with hundreds of ATMs in a concentrated area along the Riviera and Cancún, they would hardly be able to pinpoint the exact ATM where their card number had been stolen.

Then Tudor moved to Cancún, family members followed, including his younger stepbrother, 33-year-old Adrian Enăchescu. In 2015, Enăchescu became a shareholder of Top Life, the local company Tiguan had set up, along with Tiugan himself.

Tudor also brought in Ion Damian Nedescu, 49, a businessman and philanthropist from the Romanian port city of Constanța. Nedescu was a successful entrepreneur who had fallen on financial hard times. It’s not clear how they met, although Nedescu’s girlfriend at the time was from Craiova and might have introduced them.

Nedescu, who was known in Romania for his inspirational story about his single-minded efforts to help his son and many other children overcome autism, became a 20 percent shareholder and a representative of Top Life in February 2014.

The gang started upping its game, making its setup more sophisticated. Top Life provided the perfect cover for the group, giving its criminal activities a veil of legitimacy. Tudor’s crew would keep installing skimmers on other peoples’ ATMs, but the gang realized it could skim even more effectively if it owned its own machines.

Documents seen by OCCRP show the gang was buying ATMs from well-known manufacturers, including Triton and Hyosung. They would hack their processors and install their own custom-designed software to capture the bank card data.

Enăchescu became involved with other companies run by the gang, including one called Intaller, which, among other lines of business, bought and sold new and used ATMs.

But the Riviera Maya gang did not stop there. In another bold move, they secured an agreement in 2014 with Multiva, a respected Mexican bank, to brand the ATMs belonging to Top Life with the financial institution's logo.

Nedescu assisted the gang in installing Multiva-branded ATMs on the Riviera Maya. His name and signature can be seen on a placement agreement for one of the gang’s machines to be installed on the premises of a restaurant on the Caribbean shores in Tulum, another tourist hotspot.

By 2017, Top Life was operating more than 100 Multiva-branded ATMs along the Riviera Maya and in other tourist-rich locations in Mexico. Every day, tourists with tens of millions of dollars in their bank accounts collectively, stuck their plastic cards into the gang’s machines. But the gang was not greedy.

A former gang member turned witness for the Romanian prosecution described how Top Life Servicios worked in a March 2019 statement: “We controlled about 100 ATMs with chips mounted in them. ... On average, every month each machine copied about 1,000 bank cards. We would withdraw around $200 from each of these cards. $20 million withdrawn every month.”

He recalled 20 cash dispensers in Puerto Vallarta, four in Baja California, 24 on the island of Cozumel, 30 in Playa del Carmen, five in Tulum, and three in the Las Americas shopping mall in Cancún.

Top Life Servicios ended up generating $240 million a year in non-taxable income for the ever-expanding group. That would make the Riviera Maya gang one of the largest skimming operations in the world, with one out of every ten dollars skimmed globally handled by its members.

The same ex-gang member said that the organization had grown to about 1,000 members, with a core group of about 50 people who are close to Florian Tudor.

To handle the huge profits, the gang set up Inmobiliaria Investcun under the name of Tudor’s stepbrother, Enăchescu, in 2015. The company invested the group’s millions in real estate in Mexico. The gang built its main headquarters, an imposing multi-story villa with a rooftop swimming pool serviced by an elevator, on land purchased by Investcun in a prime area of Cancún.

Besides the land acquisitions in Cancún, by 2019 the company was also involved in developing a residential and golf project in Puerto Morelos, a tourist destination between Cancún and Playa del Carmen.

Other Mexican companies controlled by Enăchescu now or in the past include Alto Mundo, a gym and athletic apparel company; Mexrou, an import-export firm; Intacarrent, a vehicle rental and repair company; and Brazil Money Exchange, a firm with offices all along the Riviera Maya.

The Shark was a shareholder of Intacarrent and Brazil Money Exchange and had power of attorney over Inmobiliaria Investcun. He was also an administrator of Europe Invest, another Cancún-based company he used for investments in local real estate.

Nedescu, who has no known criminal background, would meet and greet new recruits in Cancún, typically Romanian technical experts hired by the gang, at least until 2016. After that, according to statements by former gang members, The Shark sent him to take care business in the U.S.

Tudor would not answer specific questions about the allegations of criminal activity, saying only that he was not a criminal and was being persecuted by Romanian prosecutors and Mexican police. Other gang members did not respond to attempts to contact them.

Nedescu said he could not answer questions from reporters because an official investigation is underway into Tudor’s organization.

“Until the completion of the investigations carried out by the competent bodies, I will allow myself not to express my opinion. Thanks for understanding,” he said.

Unwanted Attention

While the gang was making huge profits, it started to have other problems. After years of flying under the radar, it was seriously exposed for the first time in September 2015, when a U.S. journalist, Brian Krebs, published a story about its business.

Krebs is a former Washington Post journalist who specializes in internet security issues. In 2015, while the Riviera Maya gang was building its infrastructure in Mexico, he received a tip from a technician working for an ATM company.

“I heard from an ATM installer in Mexico who said he'd been approached by some Eastern European guys who offered them up to $6,000 a month…. The source said these guys had used Bluetooth devices that they implanted inside the ATMs,” Krebs said.

Unbeknownst to Krebs at the time, his source was talking about Bluetooth skimming devices manufactured by Cristian Simion, a Romanian technician hired to work for the gang. The technician had found a way to use the technology to beam stolen bank card numbers directly from compromised ATMs to the gang’s equipment.

The journalist hopped on a plane and went to Mexico. He easily found ATMs in Cancún, Playa del Carmen, and even the Cancún International Airport that were beaming out a Bluetooth link named free2move.

Back in the U.S., Krebs posted on his blog a three-part story about the Mexico bluetooth skimming. In the articles, he mentions being told by a source that an Eastern European gang was behind the scheme.

When Tudor learned of the story, he was furious. He contacted one of his men, Constantin Sorinel Marcu on Viber and told him to shut down their operations.

Simion, the former gang member who is now a protected witness, later told Romanian prosecutors that The Shark summoned gang members to company headquarters and told them to temporarily extract chips from about 10 of their ATMs and 25 to 30 that belonged to other banks or companies.

The Dead Man

Embarrassing as the revelations were, police never followed up on them, and the gang was soon back to its normal operations. It continued to expand its ATM network in Mexico on the back of its agreement with Multiva

Meanwhile, The Shark worked with teams of “pullers” who travelled the world extracting money using the cloned cards.

However, the same year Krebs published his expose, a far bigger problem was emerging — one that would lead to a gang feud with the Mexican police.

One of The Shark’s most trusted men was Constantin Sorinel Marcu, an enforcer and hometown friend from Craiova who freely offered to kill for his boss “any time, any hour.”

A fugitive from justice in Romania, Marcu had arrived in Mexico to work with The Shark in 2014. He had stabbed a man in Craiova, but fled the country before receiving a jail sentence for attempted murder. As in Tiugan’s case, there was an international arrest warrant issued in his name, but Mexican authorities never bothered him.

The Shark tasked Marcu with ensuring the security for the Top Life ATMs mostly in Playa del Carmen. The gang’s machines lined Avenida Quinta, the main pedestrian street where millions of tourists every year enjoy its bars, restaurants and discos.

Back in Romania, The Shark and Marcu had been close. The Shark’s Romanian wife, Rebeca Tudor, was godmother to Marcu’s daughter, and the families socialized regularly. Videos obtained by OCCRP show the Shark celebrating Marcu’s birthday in a club. The two men clink glasses and sway to the rhythm of Romanian turbo-folk music. Another video clip shows Marcu at a birthday party for one of The Shark’s children.

However, about a year after Marcu joined The Shark in Mexico, tensions started to appear between the two. Gang members-turned-witnesses said Tudor was envious of Marcu's success with women, while Marcu was unhappy with the cut he was getting from the skimming business.

Then things turned ugly.

A series of screenshots on mobile phones obtained from criminal files show Marcu and Tudor trading insults in May 2015.

Tudor confronted Marcu digitally, sending him a video on WhatsApp that showed him sabotaging one of the gang’s ATMs by smearing superglue on a card reader to render it unusable by putting superglue on the card readers. They threatened each other for more than an hour. Marcu’s main complaint was he had provided the muscle that removed the Shark’s enemies and competition, but had never been properly compensated. The Shark said he had fed Marcu’s family for the past year and saved him from his legal troubles in Romania.

The Shark instructed all gang members to cut ties with Marcu. Then, on April 2, 2018, three gang members attacked Marcu outside a DHL office in Cancún. Marcu’s spleen was removed at a Cancún hospital. The attackers and the Shark were indicted in Romania for attempted murder.

Message exchanges on WhatsApp show that days after the DHL murder attempt, Marcu was looking for revenge.

“They were following my car and I like a fool, you know I don’t run. I saw them and I passed right by them,” he texted an unknown person. “Fuck his family. He got away from the five bullets but this time this motherfucker won’t get away”

Marcu never got his chance for revenge. He was shot in the head two months later, on June 11. The circumstances of Marcu’s death are unclear. Testimony provided to Romanian authorities, as well as Marcu’s brother and parents, say he was murdered somewhere else and then his body moved in front of the gang’s headquarters and staged to look like he was killed while attacking the gang.

Tudor has denied this account.

“On that night I, my family and my workers were eating when I heard a crash and some very loud screams from [Tudor’s relative] Gabriel [Alin Stroe] asking for help,” Tudor said. He said he heard five shots and there were 20 witnesses or so but they didn’t realize until hours later that it was Marcu’s death they were hearing.

A Mexican security agent working for a company called Energy Solutions of America was arrested for the murder, but a judge who is himself under investigation for possible corrruption released the man, saying he was just doing his job defending the building’s occupants.

Marcu’s killing barely registered with police in Mexico, where about 33,000 people were murdered in 2018 alone. In fact, 2018 and 2019 are considered to be the most violent years in the country’s recent history.

But the murder seems to have been a crucial moment for the Riviera Maya gang, as it unleashed a war not only with Marcu’s family and allies, but also with factions in local law enforcement.

The Mexican Policeman

Tudor was now on the radar of the Mexican authorities.

In May of 2019, police and marines raided the Top Life offices and Tudor’s Cancún home which also served as the gang’s headquarters. Tudor and five of his associates were arrested, but later released. Tudor said the real purpose of the raid was to steal jewelry, art, cash, and computers worth more than $2.7 million.

Quick to retaliate, Tudor launched a legal assault in the months following the raids. He filed a request for constitutional protection from authorities on the grounds that his human rights had been violated, as well as a complaint of corruption against numerous officials involved in the raid. In the ensuing investigation, three members of the regional Attorney General’s Office involved in the raid were dismissed.

In February of 2020, Tudor and two of his associates published a two-page open letter against Quintana Roo State’s police chief, Jesus Alberto Capella Ibarra, in a Mexican newspaper, alleging he was extorting them, abusing their human rights, and inflicting psychological, physical, emotional and economic damage on them.

Police Chief Capella fired back at his accusers on Twitter, denouncing what he described as a “perverse … media campaign orchestrated and financed by dark interests.” Quintana Roo’s Ministry of Public Security agreed, finding that Tudor’s complaints against Capella were most likely an attempt to obstruct ongoing investigations into him and his gang.

The raids were not Tudor’s first run-in with the law that spring. Six weeks earlier, on March 30, he and his friend Nicolae were detained while driving the Cenotes Route, a jungle highway named after sinkholes in limestone bedrock that are popular swimming spots for tourists. The pair had been carrying a Glock pistol and ammunition, along with more than $25,000 in pesos and dollars.

On March 16, 2020, the Shark held a press conference at his Cancún home to argue that he was a legitimate businessman being targeted by unscrupulous police, journalists, and criminals. Seated in front of his laptop, he read off a barrage of accusations in stilted Spanish.

He said he met Marcu and his brother for the first time in a restaurant in Cancún, where they introduced themselves and asked him for work.

He said that since 2015, Marcu and his own associates had been attempting to extort and blackmail him. Marcu, the Shark alleged, threatened to kill him after he refused to involve his honest ATM business in their card cloning scheme. He claimed Marcu had not only fed false information to Krebs but had also paid him to publish his investigation. He alleged that Krebs’ story was the beginning of a “defamation campaign” that destroyed his years of hard work and ultimately lost him his contract with Multiva.

He alleged the authorities, including Capella, were on the payroll of Marcu's gang. He claimed police had planted weapons on him to justify their arrests, threatened his wife with rape, and warned their six-year-old son at gunpoint that they would make him an orphan. He provided no proof of his allegations.

In Romania, five of the Shark’s main associates have been arrested, while Tudor is being investigated for the murder attempt on his former friend Marcu.

Marcu is buried in Craiova's central graveyard. His parents visit almost every day with flowers and candles to sit by his grave.

His father told OCCRP that he sold two cars to scrounge up the money to buy the burial plot and a black marble stone bearing Marcu’s photograph and a short verse: "From you and from life I was torn. Think of me from time to time.”

Meet Some Key Players

The Brain

Most of the people involved with the Shark’s financial infrastructure are from Craiova, and at least some have had skirmishes with the law. But one of the most important players is a philanthropist from the Black Sea city of Constanța with no criminal record: Ion Damian Nedescu, 49, a businessman and renowned advocate for autistic children.

Documents obtained by OCCRP indicate that 2014 was not a good year for Nedescu. A prodigious entrepreneur involved in more than 30 commercial enterprises in Romania and the United States, Nedescu was in financial trouble. He had failed to repay his loans, and the bank foreclosed on him and took away one of his main properties in Bucharest, the Romanian capital.

That same year a different, secret life was taking shape for Nedescu across the Atlantic Ocean.

In February 2014 he became a minority shareholder, with 20 percent, in the Riviera Maya gang’s main company, Top Life Servicios. The remaining 80 percent were registered to Paul Daniel Ionete, which was the fraudulent identity used by Adrian Tiugan, aka “The Jack.”

One year later, Nedescu also received 50 percent of the shares in another of the gang’s commercial enterprises, D&D Events, a company that was authorized to organize public and private events and to run restaurants. The other half belonged to Tiugan, under the name of Paul Daniel Ionete.

By December 2014, Nedescu was assisting the gang in installing ATMS owned by Top Life Servicios, which carried the Multiva brand, on the Mayan Riviera. His name and signature is on a placement agreement to install one of the gang’s machines in a restaurant on the Caribbean coastal town of Tulum.

It is unclear how Nedescu ended up working with the gang. A witness who asked for protection from the Romanian authorities out of fear for his life said in a signed statement that Florian Tudor told him that Nedescu’s girlfriend made the introductions. He added that the girlfriend previously helped Tudor and his Romanian wife, Rebeca, get a loan from the bank where she was a director. He said The Shark needed Nedescu because he was intelligent and a skilled businessman, and spoke good English.

Another witness interviewed by the Romanian prosecutors stated that Nedescu’s girlfriend was helping the gang obtain blank bank cards, which would be imprinted with the stolen card data. She was also advising them on how to deal with the EMV cards, explaining how to bypass their encryption for efficient data collection, the witness stated.

OCCRP found that in 2015, Nedescu set up a Delaware-based company named NID Export Import Trading LLC, which had offices in New York and in San Francisco. It is unclear what this company was used for, but Romanian authorities say Nedescu was sending money from US bank accounts to gang members in both Mexico and Romania.

At the same time he was embedded with the gang’s Mexico operation, Nedescu set up a few websites including firstcheckcash.com, checks2money.com, goldcheckcash.com. None of them are still operational.

In 2014, he shipped a Porsche Cayenne from Cancún to Craiova to the Shark’s Romanian wife, Rebeca Tudor.

All along, Nedescu was living a double life.

By 2014 he had already dedicated a decade to fighting autism, a condition that was not properly researched or treated in the healthcare systems of post-communist Romania. Nedescu’s son, Radu, was diagnosed with severe autism when he was two years old. According to Nedescu, he was not speaking at all, not socializing, not learning new skills. He was completely absent.

Nedescu recounted what they went through in an essay published in 2018 on Scribd and on his Facebook page.

“First we didn’t understand anything about the situation,” he recalled, adding that the doctors in Romania didn’t suggest any viable treatment options.

“You can’t do much, there is no cure”, he said he was told. “The symptoms will keep getting worse, you will probably have to put him in a mental institution.”

Nedescu and Cristina, his wife at the time, rejected that diagnosis and started researching treatments. Finally they discovered Applied Behaviour Analysis (ABA), in which therapists help patients improve specific behaviors like communication, reading, and social skills.

While ABA is one of the most common and lauded treatments for autism, it has its detractors too, including some adults who received ABA as children. They argue that people with autism should be accepted for who they are rather than having to undergo years of intense therapy in order to appear “normal.”

The therapy requires intensive sessions — commonly about 20 hours a week, but up to 40 — focusing on each symptom of autism. As such, it is expensive and demanding.

Nedescu wrote that his family put everything else in their life on hold, so they could invest all their time, energy and money into learning the practice and applying it to their son. They decided to put ABA into practice round the clock, and recruited psychology graduates and had them trained.

After a year of treating Radu, the couple set up the “Horia Motoi” foundation in 2004. They trained psychologists, developed a toolkit, an early diagnostic method and worked on changing the perception of autism.

According to Nedescu’s Facebook essay, the therapy appeared to work and Radu made so much progress that he was able to attend school. He passed exams, made friends. He started writing. He graduated.

Today, Radu Nedescu is studying philosophy in Belgium. He writes poetry and speaks publicly about his condition and impressive recovery.

Nedescu started a PR campaign around his son’s story, making the round of radio and television shows in Romania to extol the benefits of ABA therapy. In one interview, the host of “The Best Dad” introduces him by saying, “If it wasn’t real, Damian Nedescu’s story would have to be invented by a writer”.

Nedescu is asked to imagine what his children will say about him when they are his age, and answers: “A bit crazy, but look how good we turned out!”

“A bit crazy” might be an understatement.

At the same time he dedicated his life to treating autism, Nedescu was getting deep into business with Tudor and his organization.

Nedescu is the official representative of Intaller, another Mexico company that bought ATMs for the gang, and he is a shareholder in the organization’s two largest companies. He was also responsible for meeting and accommodating new recruits when they arrived in Cancún.

The Technician

The Riviera Maya gang needed quality technicians to design and build its increasingly sophisticated skimming devices. Many of these were recruited from Romania’s booming tech industry.

Cristian Simion, 44, is a Romanian radio transmission technician. In January 2014, he was looking for a job and came across an online announcement that advertised good pay in Germany for people familiar with Bluetooth and other wireless transmission technologies. Simion responded to the ad and a month later received an email informing him that the job was still available but its location had changed from Germany to Mexico.

He was soon talking via Skype with a Riviera Maya gang member.

The engineer was only asked one question: Can you solder? His answer was yes so he got hired and, in May 2014 landed in Cancún. The person to welcome him was Ion Damian Nedescu.

They met at a Starbucks in the center of Cancún, across the street from Top Life Servicios headquarters. They spent the next three days together in the two-storey company building where bedrooms were arranged.

It was the fourth day that he finally met Cosmin Adrian Nicolae, 38, the gang member with whom he previously spoke on Skype.

Nicolae was also from Craiova and a top-tier member of the gang. His job was to place and keep tabs on the Top Life ATMs. He bribed technicians from other ATM companies to allow the Riviera Maya gang to place skimmers inside other banks’ cash machines.

Nicolae was a shareholder or had power of attorney in seven of the gang’s Mexican companies, including Intaller, the company that Nedescu represented in relation to the Mexican authorities.

Nicolae gave Simion some money to send back to his family in Romania and told him to relax and try to accustom himself to life in Mexico. Three weeks later he was properly introduced to the group in an initiation ceremony.

In a statement to Romanian prosecutors, Simion said he met Florian Tudor a couple weeks after arriving in Cancún.

That same evening, he was taken to a mansion in Novo Cancún, a posh new Cancún neighborhood on the beach. He was met there by Tudor and some of his people and was asked to snort cocaine, while group members assessed him and voted on whether he was worthy of joining their ranks. With a glass of red wine, Tudor finally initiated him into the gang.

Soon afterwards, Simion understood what he was really brought to Mexico for: skimming. He went along with it for a while and worked with The Shark, Nicolae, and other gang members to install skimming devices and software in their ATMs.

Most of the work Simion did was at the Top Life Servicios headquarters in Cancún, but the gang also had business in Playa del Carmen, where other Romanian technicians, some of them brought to Mexico by Simion himself, were settled.

Simion said that by 2017 he wanted out. He told Romanian authorities that he found work with a Mexican advertising company in January 2017 to get some distance from the gang.

His initiative was not received well by the Shark. One January 2017 evening, Tudor asked Simion to come to a Romanian restaurant in Cancún open only to gang members. He then instructed him to call an ambulance, and began beating him with a rubber hose. Throughout the 20-minute assault, Tudor told Simion that Mexico was his country and nobody could leave and go on business ventures of their own.

Tudor beat him up again the following day at the Top Life Servicios office, Simion said.

Three months later, Simion fled Mexico, flying first to Frankfurt, Germany, and then to the Romanian capital Bucharest. But the Shark’s people tracked him down, and he soon heard from Tudor himself, warning him in messages sent over Viber that he had better not talk to the authorities.

“You ran like a faggot. ... If you left with any bad intention, you won’t get away on this Earth. I know where you live,” the Shark wrote.

Tudor mentioned that he had contacts with Mexican law enforcement agencies and threatened to have them open a case against him and issue an international arrest warrant.

“A criminal case is made up quickly here. You know well. Be careful, they might investigate you for drug trafficking,” he wrote.

Three months later, in July 2017, the Shark insisted that Simion return to Mexico. He sent photos of Simion’s children going to school, a warning that gang members were watching.

In August 2017, Simion agreed to return to Cancún and work one more month for the gang. But the following day two of The Shark’s enforcers came to his home and threatened him. After they left, Simion tried to get in touch with The Shark, but he did not take his calls. The Shark called two days later and said one of his lieutenants had forgotten to tell the enforcers not to bother him as they had made an agreement.

The incident added to Simion's distrust of Tudor, and he refused to go back to Mexico. He left his home and is now a protected witness against the Shark and his gang.

The Traveling Pullers or Skimmers

Sorin Velcu’s itinerary over the past few years looks like a backpacker’s dream.

The native of Craiova, Romania, has sipped cocktails in the Caribbean island of Grenada and spent time in the tourist-packed beach town of Kuta, Indonesia. But he was on a mission, not a vacation. Velcu was one of the Riviera Maya gang's "pullers," sent all over the world to withdraw cash from ATMs using cards imprinted with stolen bank account information.

But pullers like Velcu were not just extracting money; they also mounted skimming devices on ATMs in different countries in order to obtain new bank card data.

The Riviera Maya gang kept close track of all the banking information they harvested. Romanian police obtained a ledger that records batches of hundreds of credit and debit card numbers, pin numbers, the names and nationalities of banks that issued the plastic. In many cases, the amount of money illegally withdrawn from the cards was noted. The gang also paid attention to the type of card (whether it had a chip, just a magnetic strip, or both) and made notes on what types of ATMs accepted which cards.

That information was funnelled into the Riviera Maya gang’s bookkeeping by people like Velcu. The 35-year-old is muscular, tattooed and usually sports a closely-trimmed beard. He only attended one year of school, and used to drive a Chevrolet Camaro around Craiova without a license. These days he is awaiting trial on charges of organized crime activities due to his affiliation with the Riviera Maya gang.

It is just the latest of Velcu’s many brushes with the law in different countries.

According to a U.S. court record, Velcu was arrested in August 2005 in McAllen, Texas, after crossing from Mexico in a group over the Rio Grande River. He failed to appear for a Texas immigration hearing and was ordered to be deported. He was then smuggled into Canada in September 2005 where he was granted refugee status. He was again arrested and removed from the U.S. in 2007 when he illegally crossed the border from Canada.

He made another attempt to enter the U.S. in 2016, again via Mexico. He told Romanian authorities that he was unsuccessful and he lived for a short while in Mexico City.

In 2019 Velcu was arrested on three continents: in the Caribbean nation of Grenada, the Indonesian island of Bali, and back home in Romania.

February found Velcu partying in Grenada, where he posted videos to Facebook that showed him enjoying a cocktail of whiskey and coconut water. Shortly afterwards, he was arrested after being caught trying to extract money from an ATM with a stolen card.

Undeterred by the legal setback in the Caribbean, Velcu made his way to Bali the following month. Police caught him and three others using cloned credit cards. He spent seven months in prison in Indonesia and then returned to Romania where he was arrested again.

Indonesian police had been tipped off by Romanian authorities who had discovered that Velcu and the gang were using a Romanian travel agent to book their plane tickets. The police obtained a warrant to monitor the communication of the agent and kept themselves updated with the air tickets purchases. When Velcu and his people bought a ticket, the Romanian authorities would inform their counterparts in the other countries that the gang was planning to visit their territory.

Yet, even when pullers were caught, they seldom faced severe penalties.

Last year in February, two gang members were detained in Barbados where they roamed the island withdrawing money with cloned bank cards and installing skimmers to get more card data. The cards were glued to their body with tape when the police apprehended them and they pled guilty.

By the end of the month they were free, and were deported after paying a $10,000 fine. A local publication quoted the judge saying: "It is best to see the back of you so taxpayers don't have to fund you.”

Western Union receipts seen by OCCRP show how the gang mobilized to save their people.

The money, 25,000 Barbados dollars, to pay the fines for both men were sent from Western Union offices in Craiova and Bucharest to lawyers in Barbados. The money was sent in several installments by different people.

The two were deported from the Caribbean country.

A few days after the arrests in Barbados, another of the gang’s pullers was stopped at Cancún airport after a flight from Panama, which is a regional flight hub.

Maria Dumitru, 32, was carrying 80,000 Barbados dollars (about $40,000), which she did not declare to customs. It is not clear how she got the Barbados currency, but one of the pullers arrested in the Caribbean country was the cousin of her husband Gheorghe Dumitru, 38, who was on the flight from Panama with her. Velcu and Dumitru are brothers.