Mexico Asks The US To Extradite Florian Tudor Operator Who Collaborated In 2017 BBVA Fraud

"Sol Prendido" for Borderland Beat

Dumitru is accused in Mexico of having participated in the million-dollar operation by hacking ATMs

Dumitru is accused in Mexico of having participated in the fraud operation

Gheorghe Dumitru, an operator for Florian Tudor, alias El Tiburón, leader of La Banda de la Riviera Maya, is detained in the United States and the Mexican government has already requested his extradition.

In the judicial file in which they are requested to be sent to the Mexican authorities, to which MILENIO had access, it is detailed that Dumitru was a card operator, within the fraudulent scheme of Tudor and his criminal colleague Cosmin Adrián Nicolae.

Dumitru is accused in Mexico of having participated in the million-dollar fraud operation against BBVA in 2017, by hacking ATMs and cloning bank cards through skimming, a method in which a hidden device is placed in the slots of ATMs, to copy the data from the magnetic stripe when the customer inserts their card.

Florian Tudor is in the Altiplano prison

“The criminal organization specialized in illegal ATM skimming operations and maintained a complex and well-organized structure to achieve those goals. The criminal organization was led by two men, Florian Tudor and Cosmin Adrian Nicolae, who planned, organized, directed and supervised the criminal organizations,” the court file reads.

Dumitru was arrested in November 2021 for bank fraud conspiracy and identity theft, stealing cash from nearly 80 ATMs in California. He is currently in prison in Atlanta, Georgia.

The multimillion-dollar fraud was detected on March 16, 2017, when BBVA reported insufficient cash in its ATMs in Mexico City and Cancun.

Mexican authorities began to investigate and discovered that during the previous two days, massive cash withdrawals were made, in what was called Operation BBVA. At the front: the Riviera Maya Band, which has been operating since at least 2016.

“The rest of the members were divided into two categories: technicians and card operators,” details the case against Dumitru.

The technicians were in charge of designing a virus that broke BBVA's protection barriers to allow cash withdrawals from ATMs, using devices called skimmers in the ATMs. The gang used a front company to get ATMs placed in various places in Mexico, such as the capital, Cancún, Quintana Roo and Mérida, Yucatán.

Once the ATMs were placed and hacked, operators, like Dumitru, went into action: they had to withdraw massive amounts of money to empty the ATMs using cloned bank cards.

“A security guard who worked for Tudor reported that prior to Operation BBVA, she observed large amounts of money and several blank bank cards in Tudor's home and in cars belonging to his children. She later learned from another employee that the bank cards were used to illegally withdraw money from ATMs. The security guard also observed the technicians opening and carrying out work on ATMs and writing on safety sheets that they were going to repair ATMs and skimmers,” is detailed in the file of which Milenio has a copy.

According to the Mexican government's investigation, which supports his extradition request, on February 27, March 5 and March 7, 2017, Cosmin Nicolae tested several cloned bank cards in ATMs that had skimmers to check their effectiveness. She used a bank number related to Banco do Brasil.

On March 15, 2017, during a party at his house in Cancún, Quintana Roo, Florian Tudor then announced the start of Operation BBVA. Although El Tiburon never left his shelter; He coordinated everything from his house.

Thus, between March 15 and 16, 5,175 cash withdrawals were made at 477 ATMs in CdMx, Cancún and Mérida. In total, they illegally acquired 70 million 376 thousand 300 pesos.

El Tiburon was not the only one who was hidden during the operation. The technicians were at a private residence where they remotely reviewed information, made transfers and authorized transactions at the hacked ATMs to allow card operators to withdraw money.

“Employees working at the Tudor home during the operation described unusual activity at the home during Operation BBVA. A security guard explained that she was denied entry inside Tudor's home on March 16, 2017. Although she was prohibited from entering the home, the security guard, from her guard position in the house, observed an unusual number of people arriving at the home during the day. The individuals carried black briefcases or bags, which they left at Tudor's home. In addition, the security guard saw one of the Tudor employees carrying an open bag that had wads of bills in it,” the file states.

Although the operation was not completely clean

BBVA traced the withdrawals to 12 bank BIN numbers related to Banco do Brasil, one of them that Nicolae used to perform the withdrawal tests. Later, his criminal colleague, Florian Tudor, and his female colleagues began to be tracked.

Dumitru was identified by witnesses and videos as an operator of the Riviera Maya Gang.

“Employees who worked at the Tudor home identified Dumitru as a member of the criminal organization and a participant in Operation BBVA. According to an employee with knowledge of Operation BBVA, Dumitru came to the area with his family in 2016. Tudor considered Dumitru a special guest and gave her a home to stay with his family. The employee identified Dumitru as a member of the criminal organization and explained that Dumitru worked as a card operator during the operation.”

Additionally, videos from a BBVA security camera in Cancun show Dumitru making 285 cash withdrawals with Banco do Brasil cards linked to Nicolae. He withdrew 3 million 533 thousand pesos. With the video, the Mexican government requested a photograph of Dumitru from the FBI and it was determined that it was the same person. Even the security guard at the Tudor house identified him with the nickname Romeo.

In Mexico, Romeo is already accused of criminal association and illegal withdrawal of money from credit institutions, and has an arrest warrant issued by a judge at the Reclusorio Sur. He is currently detained at the Atlanta Penitentiary, Georgia, and has already been presented before a judge, with the extradition trial pending. With it, El Tiburón, detained in Mexico since May 2021, is on the verge of sinking to the bottom of his career. 

Since February 2021, Milenio announced the million-dollar BBVA Operation, and the complaints from the banking institution. The case also uncovered a network of politicians who protected Tudor in addition to other heists, although not as large, to institutions such as Citibanamex, Wells Fargo, Chase, Bank of America and TD Bank.

Milenio