An alleged top boss of a Romanian crime syndicate that U.S. authorities say is responsible for deploying card-skimming devices at Automated Teller Machines (ATMs) throughout North America was arrested in Mexico last week on firearms charges. The arrest comes months after the accused allegedly ordered the execution of a former bodyguard who was trying to help U.S. authorities bring down the group’s lucrative skimming operations.
On Mar. 31, police in Cancun, Mexico arrested two Romanian men, identified only as 42-year-old “Florian N” and 37-year-old “Adrian Nicholae N,” 37, for the possession of an illegal firearm and cash totaling nearly 500,000 pesos (~USD $26,000) in both American and Mexican denominations.
The two men’s faces were partially obscured in the mugshots released to Mexican media. But according to multiple sources familiar with the investigation, the older man arrested (pictured on the left) is Florian “The Shark” Tudor, reputed to be in charge of a relatively new ATM company based in Mexico called Intacash. The man on the right has been identified as Nicolae Cosmin, Tudor’s deputy.
Intacash was the central focus of a three–part investigation KrebsOnSecurity published in September 2015. That story tracked the activities of a crime gang that was bribing and otherwise coercing ATM technicians to install sophisticated Bluetooth-based skimmers inside cash machines throughout popular tourist destinations in and around Mexico’s Yucatan Peninsula — including Cancun, Cozumel, Playa del Carmen and Tulum.
Meanwhile, Intcash’s machines were about the only ATMs in top tourist spots in Mexico that weren’t getting compromised with these bluetooth skimming devices.
Law enforcement and ATM industry sources cited in that story said they believe Intacash is controlled by Romanian nationals and that its key principals were the ones paying ATM technicians to compromise machines at competing ATM providers.
As I discovered in reporting that series, it was possible to tell which ATMs were compromised in Mexico’s top tourist spots just by approaching each with a smart phone and looking for the presence of a Bluetooth signal beaconing out a wireless network with the name “Free2Move”.
This functionality allowed the crime syndicate to siphon credit and debit card details and PINs from hacked ATMs wirelessly, without ever again having to touch the compromised machines (see the video below for more on that investigation).
In April 2018, KrebsOnSecurity heard from a Romanian person who claimed to have been working for Intacash. This individual seemed extremely concerned for their safety, but at the same time eager to share details about the company’s operations and owners.
The source shared photographs of Intacash’s chief deputies, as well as screenshots of card data allegedly hoovered up by the company’s various skimming operations. The source repeatedly told me the Romanian gang was paying large sums of money to Mexican authorities to stay off their radar.
The last time I heard from that source was June 2018, just after a like-minded associate at Intacash was found shot dead in his car. The associate, 44-year-old Sorinel Constantin Marcu, was already wanted on a warrant from Interpol, the international criminal police organization.
In 2014, a Romanian court issued a criminal warrant for Marcu on allegations of attempted murder back in his hometown of Craiova, Romanian’s 6th-largest city. But Marcu was able to flee to Mexico before he could be tried. The court later convicted Marcu in abstentia, leveling a sentence of eight years in prison.
On the evening of June 11, 2018, Marcu was shot in the head, reportedly while trying to kidnap a businessman in Mexico, according to multiple media accounts. A street surveillance video of the incident published by Romanian daily Gazeta de SUD shows a Dodge Nitro allegedly driven by Marcu hitting the businessman’s parked car.
The businessman manages to flee, and the passenger in Marcu’s vehicle briefly starts after him, before returning to the picture a few seconds later. Marcu’s passenger gets back in the vehicle, which then moves out of view of the security camera.
“Later, one of the businessman’s guards came out of the house and shot several gun shots in the car driven by Marcu, and he was killed on the spot,” Gazeta reported.
My source’s last communication was that they had tried to reach out to U.S. federal investigators but hadn’t had much luck. The source wanted the name and a number of someone to talk to at the FBI or Secret Service.
That source also said corrupt Mexican authorities were complicit in changing the news media narrative of what happened to Sorinel Marcu.
“Hi Brian do you have some news about your contact? Because the person who was going to testify now is dead,” my source wrote. “The boss of the gang do it, who I told you kill him, now he pay a lot of money to change the real story, and now that Cancun’s police work for him. Because the maybe guilty stayed 24 hours arrested (or less) for homicide. Please if this week you can do something for us, help us!”
Searching for others who might have knowledge of the shooting, I found a Facebook posting by Marcu’s brother — Aurelio Marcu — who commented on a Facebook video recorded shortly after Marcu’s execution in which bystanders can be heard telling those approaching the car not to move his brother’s body. The video was posted by a Mexican news channel, which reported the men questioned by police in connection with the incident were carrying Russian passports.
“They are from Romania, not Russia,” Aurelio Marcu wrote in a comment on the video, saying the boss of the gang is a guy named Tudor Florin, also known as “Rechinu” or “shark” in Romanian.
In an interview with KrebsOnSecurity, Aurelio Marcu said his younger brother was killed in front of a new apartment complex being built and paid for by Mr. Tudor, and that the dead man’s body was moved to his car to make it look like he was slain there instead. He also said his brother and the passenger in the Dodge Nitro were following a man who worked in Tudor’s crew, not some random businessman.
“He was unarmed, and if you look at the pictures in the papers from his death, you can see he is wearing flip flops when he was shot,” Aurelio Marcu said, speaking through an interpreter. “How can you go kidnap someone wearing flip flops and with no weapon?”
Marcu the elder said his dead brother long served as Tudor’s personal bodyguard, but at some point the two had a falling out over the money and women. Marcu said things got really tense between Tudor and his brother when the latter began sabotaging Intacash’s operations by applying superglue to the PIN pads and card acceptance slots of Intacash ATMs throughout Cancun.
Marcu said Tudor’s crew had tried once before to kill his brother, but only managed to seriously wound him in a knife attack that ruptured his spleen.
Asked why he believes Florian Tudor was responsible for his brother’s death, Marcu said Sorinel “was an impediment for them, and Mr. Tudor was afraid that he would talk to the police.”
Marcu said Tudor and his associates are working with criminal syndicates in China, India and Indonesia to help cash out credit and debit card accounts stolen via Intacash’s extensive ATM skimming operations. He also said Mr. Tudor is reputed to keep up to USD $50,000 in cash on hand at all times, just in case he needs to buy himself out of a sticky situation with the police.
“This is so that if anything happens to him, he has a window to escape,” Marcu said. “He used to brag that he had days when he was making like $200,000 a day doing all this ATM and fake credit cards stuff.”
Additionally, Marcu said Mr. Tudor is working on building a theme park in the Puerto Morelos area of Quintana Roo, a Mexican state on the Yucatan Peninsula that encompasses Cancun and other tourist areas close by.
Aurelio Marcu says he and his brother are from the the same hometown as Tudor and his crew — Craiova, Romania, and that he’s been living under active protection from the Romanian police out of fear for his life.
Marcu is doubly worried now because he’s recently learned that both Tudor and Cosmin made bail on the weapons charges. He believes they are probably trying to figure out how to quietly wind down their operations in Mexico and flee the country.
KrebsOnSecurity has learned that Tudor and others alleged to be part of the Romanian ATM skimming ring in Mexico are the target of a more wide-ranging FBI investigation into the alleged Romanian crime family. The FBI did not respond to requests for comment.
According to people briefed on the investigation, Mexico is a central hub for hundreds of individuals from Romania who have moved into tourist areas to help execute various ATM skimming and money laundering schemes there and across the border in the United States.
Those officials describe the Romanian crime network in Mexico as part of a far larger criminal syndicate that has foot soldiers who are ready and able to execute ATM skimming attacks throughout North America and in virtually every major U.S. city.
Sources say Romanian intelligence services also have been keeping tabs on this group’s operations south of the U.S. border — specifically on Mssrs. Tudor and Cosmin, as well as the now-deceased Sorinel Marcu.
Mr Krebs… it’s funny, but Nicholae Cosmin does look like you in that mugshot 🙂
What? No I don’t…
Nicolae, you are my best agent. Good job!
Putin, believe me, we’ll catch all of your crooked cronies, believe me. It’ll be great, so great, and believe me, it will happen swiftly, very swiftly. You won’t have a chance to enjoy your cup of covfefe, believe me.
You really are that stupid? Or mentally challenged? Mentally challenged can be worked with….but YOU CANT FIX STUPID.
No Humans Involved.
Other-level reporting here, Brian. Fantastic.
That story tracked the activities of a crime gang that was bribing and otherwise coercing ATM technicians to install sophisticated Bluetooth-based skimmers inside cash machines throughout popular tourist destinations in and around Mexico’s Yucatan Peninsula — including Cancun, Cozumel, Playa del Carmen and Tulum.
Just to bring you some insight on the matter.
Craiova is one of the cities in Romania, where the card and internet fraud are rampant. 12-15 years ago this trend started and you could see highschool kids in expensive clothes, with expensive cars and no income.
They all started with fake ads on american websites (some kind in my high school apparently sold a fictive yacht) and then moved on to card fraud. I knew at least 10 persons doing this, when i was in highschool. Some of them ended up for 1 or 2 years in prison, but kept everything they “made”.
When the organised crime groups in the city saw what these kids were doing, they started offering them protection from the authorities and got in on the action. That’s when everything went rampant.
Some of those groups had people in Mexico, that were in charge of smuggling illegals over the border to USA (we’re very crafty people, us romanians, just like all eastern europeans). From smuggling illegals to jumping the border and install skimmers was a breeze.
Kids whose parents were lawyers, judges, prosecutors, police officials, were driving Ferraris and Hummers, while living in a one bedroom apartment in old communist apartment buildings. In the meantime, the Romanian secret services cracked down on them with help from Interpol and FBI, so only the large organised groups remain active.
One thing is sure. If you want to use an ATM, Craiova is the safest place, since these guys never work in their hometown. You may get knocked on the head by one of the other 98% of the persons living on the edge of poverty, but at least you won’t get “skimmed”.
Yours truly, someone who left that city at the first chance.
Thank you for sharing your insight.
I really enjoyed reading this story. I’d love to see you reporting more about the organized crime. But also, I like almost every single story of you, so please stay safe! There’s nothing similar that can keep up with your reporting/journalism level.
I had no idea Romanians were running rampant in Mexico or that they were even a threat. Maybe Trump’s border security shouldn’t be so easily dismissed by the Dems.
By comparison with Romania, the Mexican resorts along the Yucatan’s eastern coast are both pleasantly warm and very welcoming pretty much year-round, as well as flush with mostly US cash from its tourist-driven economic machine. While Romania does have some beachfront resorts on the Black Sea, the seasonal window is both short and historically dominated by Russian tourists, who don’t tip particularly well.
Those local syndicate reps in the Yucatan aren’t interested in crossing the US-Mexico border.
Brian, thank you for reporting this stuff. I can’t see any major network ever taking the first step toward this level of journalistic integrity. They are to worried about political posturing to be anything more than propaganda. I so wish there were major media in the world that are worth respecting. But I guess that’s why you went independent.
Awwww…now they’re going to be separated from their families. They only wanted to come to the US for a better life.
*beep boop* I sense sarcasm *beep bop*
You only heard a “beep boop”? What I heard in my head was a tornado warning siren…
/five minutes later/
Now, that’s more like it! Guess the only thing which might improve on that bit would be an MP3 clip of Warren Zevon singing the refrain to “Werewolves of London”…
That’s a complete lie. And, it’s not funny. If they truly wanted a “better” life….they wouldn’t have done this. We all pay for our sins, our mistakes. May God have mercy on their soul.
The National Sarcasm Warning Service has announced that the danger has passed and the order has been lifted. 😉
“the Romanian gang was paying large sums of money to Mexican authorities to stay off their radar.”
Why am I not surprised?
In Mexico corruption is the “normal ” way of life.
Thank you for beacon of light in this world of darkness. You already know this but… please… please.. please. never give up the good fight even till the very end.
Thank you again for informing the general public or those willing to listen to wisdom or careful analysis of the current state of computer security.
Check your email.
There’s a factual error in the story.
A couple more Romanians were convicted today. https://www.justice.gov/opa/pr/two-romanian-cybercriminals-convicted-all-21-counts-relating-infecting-over-400000-victim Bogdan Nicolescu and Radu Miclaus. Seems like there’s so much we could do to cut off people like these guys.