The Riviera Maya gang: Romanian ATM skimming organization operates in Mexico

A group of entrepreneurs from Craiova, Romania , learned everything they could about banking and build an ATM company. Soon, they were operating in Europe, Asia, and America. They invested their profits in new technologies and hired experts.

The Romanian entrepreneurs invested in Mexico; however, it was soon discovered that they were a group of skimmers , criminals who steal credit card information by installing illegal software and hardware in ATMs .

The gang leader was Florian Tudor, a renowned criminal who is also called “The Shark.” According to reports, the criminals expanded to other offenses such as money laundering, harassment, bribery , and murder .

According to the police and former gang members, they are one of the most powerful skimming groups in the world and control almost 10% of a global market valued at USD 2,000 million.

OCCRP

, Mexicans Against Corruption and Impunity ( Mexicanos Contra la Corrupción y la Impunidad ), and Quinto Elemento Lab went through thousands of documents, interviewed people in three continents, and tracked social media accounts to solve the mystery.

Although criminals have been arrested on several occasions, they continue operating all over the world.

Recommended: Record number of online frauds in Mexico

A very expensive vacation

Rod, who hails from Texas, traveled to the Riviera Maya and was one of the victims of the Romanian criminals. In a few minutes, they stole USD 800 from his bank account. Besides Rod, thousands of tourists have been facing the same issue since 2012, when a Romanian criminal group settled in Cancún .

“The Shark”

Florian Tudor

is a 43-year-old businessman. According to Romanian authorities, he is the leader of the Riviera Maya gang . According to several sources, the organization has over 1,000 members and many of the new buildings in Cancún were built using the money Tudor obtained through skimming .

Romanian authorities

launched an investigation against Tudor in January 2020 for several crimes, including organized crime, incitement to blackmail, and incitement to murder. Mexican authorities are also investigating him.

Romanian authorities argue that Tudor ordered his men to threaten, bet, blackmail, and kill his enemies. According to the police, in 2012 he orchestrated human trafficking operations from Romania to the United States through Mexico.

Tudor, who still lives in Mexico, denies all the accusations.

In an e-mail exchange with OCCRP, Tudor said he is “not a criminal and never will be.”

Florian Tudor

claims to be a businessman, the victim of corrupt authorities in both Mexico and Romania, who have been bribed by criminals. He also accused the Mexican police of stealing money from him and said that OCCPR journalists are collaborating with corrupt authorities.

From Craiova to Cancún

Tudor moved to the Riviera Maya in 2014, where he is known as “The Shark.” He was followed by many other Romanians.

One of these Romanians in Adrian Tiugan , a 36-year-old thug who is also known as “Mufa” or “Jack.” He had been previously arrested in Italy and the Vatican in 2012, when he was sentenced to two and a half years in prison for altering ATMs .

In December 2013, Tiugan moved to Mexico and opened a company called Top Life Servicios in Cancún, where it would operate ATMs.

Tiugan registered the company under the name of Paul Daniel Ionete , a Craiova resident. Tiugan used his residence permit and a false Romanian passport to steal his identity. However, no evidence indicates Tiugan had trouble with Mexican authorities, even when Romanian authorities issued an arrest warrant against him.

In one of the e-mails Tudor sent to OCCRP, he denied he, his brother, or his partners use false identities because they “have nothing to hide.”

However, according to sources, the criminal band operates in Indonesia, India, Barbados, Grenade, Paraguay, Brazil, Japan, South Korea, and Taiwan.

In 2015, Adrian Enachescu, Tudor’s stepbrother, moved to Cancún and became a stakeholder at Top Life.

Later, the Romanians were followed by Damian Nedescu , a 49-year-old businessman and philanthropist. Nedescu was a successful businessman who was facing financial troubles, and in 2014, he acquired a 20% stake at Top Life and became a legal representative for the company. It is unclear how did they know each other, although Nedescu’s then-girlfriend was from Craiova.

Recommended: The 6 most common types of fraud in Mexico City 

Legal documents obtained by OCCRP show that the gang began by purchasing Chinese ATMs from two brands: Triton and Hyosung . They hacked the systems and installed their software, designed to steal financial information.

Later, Enachescu got involved with other companies led by the criminal organization, including Intaller , which purchased and sold ATMs.

Nevertheless, their crimes didn’t end there. In 2014, they reached an agreement with Multiva , a large Mexican bank. By 2017, Top Life operated over 100 ATMs in the Riviera Maya and other touristic hotspots in Mexico.

In 2019, a former member who became a witness and now cooperates with Romanian authorities said that while he worked at Top Services: “We controlled around 100 ATMs with chips installed in them (…) On average, each machine copied 1,000 credit cards per month. We got around USD 200 from each of those credit cards. USD 20 million each month.”

He also said they had installed 20 ATMs in Puerto Vallarta; four in Baja California; 24 in Cozumel; 30 in Playa del Carmen; five in Tulum, and three inside Las Américas mall in Cancún.

In total, Top Life Servicios registered profits for up to USD 240 million every year after taxes. This turned the Riviera Maya gang into one of the largest skimming organizations in the world.

The former member also said that the organization is formed by 1,000 members and that 50 of them are close to Florian Tudor.

In 2015, the gang opened Investcun , a realtor, and Enachescu was put in charge. The company invested millions in properties throughout Mexico. Later, the criminal organization built its headquarters in a luxurious neighborhood in Cancún.

By 2019, the company was also involved in the development of a residential project and a golf club in Puerto Morelos.

Furthermore, other companies controlled by Enachescu include Alto Mundo , Mexrou , Intacarrent , and Brazil Money Exchange .

“The Shark”

was a stakeholder at Intacarrent and Brazil Money Exchange, he also had power of attorney at Investcun. He was also a manager at Europe Invest , a Company based in Cancún.

OCCRP reached out to Nedescu, who said he was unable to answer the question because there is an ongoing investigation into the organization created by Tudor.

Recommended: Organized cybercrime increases in Mexico

 
Unwanted attention 

The Riviera Maya gang gained notoriety in 2015 when U.S. journalist Brian Krebs published an article about them. Krebs’ source told him about Bluetooth and skimming devices created by Cristian Simion , a Romian expert hired by the criminal organization, and who is now a protected witness.

Krebs then traveled to Cancún and corroborated how did the skimming system operate. When the journalist published the story, Tudor was enraged and told Constantin Sorinel Marcu to close all the operations.

Marcu was trusted by Tudor and they were old friends. Constantin Sorinel Marcu was in charge of the security of the Top Life ATMs, especially those in Playa del Carmen.

However, one year after Marcu moved to Mexico, tension arose between the two. Some say Tudor was jealous of Marcu’s success with women and that Marcu was not satisfied with the money he received. The men got into a fight in May 2015 and Tudor told his men to cut all ties with Marcu. In April 2018, four men shot Marcu in Cancún but he survived, however, he was shot dead two months later.

The Mexican police

Tudor is now a target for Mexican authorities .

In May 2019, the police and the army registered the Top Life offices and Tudor’s home. “The Shark” and five others were arrested but were quickly released. Meanwhile, Florian Tudor said that Mexican authorities took this as an opportunity to steal USD 2.7 million in jewelry, art, cash, and computer equipment.

In the upcoming months, Tudor launched a legal battle against Mexican authorities and argued that his human rights were violated.

In February 2020, Tudor and two others published an open letter directed at Jesús Alberto Capella Ibarra , the local security minister, in a newspaper. They accused the official of extortion .

However, this wasn’t their first clash with the law. In March 2019, Florian and Nicolae were detained with they drove through a road known as the Ruta de Los Cenotes.

On March 16, Tudor organized a press conference at his home. He insisted on his innocence and said he was targeted by the corrupt police, journalists, and criminals.

He also said that since 2015, Marcu and his men tried to blackmail and extort him. According to “The Shark,” Marcu threatened him after he refused to participate in a fraud and that in retaliation, Marcus gave Krebs false information that destroyed years of hard work and in him losing his contract with Multiva .

He also claimed Marcu bribed Mexican authorities, including Capella. He also said the police planted evidence and that they threatened to abuse his wife and kill his 6-year-old son but failed to provide evidence that supported his claims.

Capella denied the accusations. Quintana Roo authorities said that Tudor was trying to obstruct the investigations against him and his organization.

In Romania , five of Tudor’s collaborators are being investigated for the murder of Marcu.

gm