Two members of a Romanian bank-fraud syndicate have been arrested on federal charges that they siphoned hundreds of thousands of dollars from individual bank accounts from Boulder to Kansas City.
Gabriel Daniel Toma-Stoica, 45, was indicted Tuesday in Denver U.S. District Court on one count of bank fraud and using cloning devices to copy credit cards inserted into ATMs.
Toma-Stoica’s alleged accomplice, 49-year-old Daniel Mahu, was indicted March 22 on two counts of fraud using cloning devices.
Agents from Homeland Security Investigations are still trying to identify the leader of the credit-card cloning operation who operates in North Hollywood, Calif., and is known only by the name, Gogu, according to federal court records.
The thieves have acknowledged placing card cloning devices — also called skimmers — on ATMs. When a customer puts their credit card in the ATM, the skimmers capture electronic data that allows thieves make fake cards they then use to steal money from individual bank or credit union accounts.
Toma-Stoica, also known by the alias Ferenc Galyas, was first captured on ATM video machines of Bank Midwest in the Kansas City metro area in November. Bank fraud investigator William Hall said Bank Midwest suffered more than $200,000 in losses. Other unidentified people believed to be members of the syndicate were also recorded by ATM videos inputting clone cards into ATMs and later making large withdrawals from individual bank accounts.
The first clone device was implanted in a Denver area credit union ATM on Dec. 23, court records indicate.
On Jan. 2, an Arvada woman noticed that something very suspicious was happening with her Sooper Credit Union account. Someone had drained $500 from her account from Aurora on New Year’s Eve. On New Year’s Day another $500 from a Boulder branch of the credit union.
A Sooper Credit Union executive who reviewed several videos of a stocky, blonde man recording using a clone card at various banks to withdrawing money from the Arvada woman’s account told Homeland Security that the suspect appeared to be Russian.
Federal investigators determined that the man drove two rental cars, including a 2018 Ford Fusion rented at Bob Hope Airport in Burbank, Calif.
Court records say Mahu rented the cars and put thousands of miles on them. Mahu, a Romanian national, had entered the U.S. under a B2 visitor VISA on Aug. 3.
Mahu rented a 2017 Nissan Altima at a Westminster Enterprise store on Jan. 20. Before he returned the car on Feb. 2, court records say agents followed the car as it traversed the Denver metro area, making stops at United Parcel Service.
Arvada police installed a tracking device on the Altima and obtained information from Crossland Denver Hotel, where Mahu was staying. Toma-Stoica had rented the motel room under an alias using a Romanian passport.
When agents served a search warrant on the Crossland Denver Hotel they discovered a Greek passport belonging to Mersinis Ioannis. Behind a painting on the wall, they found an envelope containing Toma-Stoica’s passport. It indicated he entered the U.S. traveling from Mexico on May 7, 2017. There was also a fraudulent Hungarian Passport with Toma-Stoica’ photograph and his alias, Galys.
The arrests of Mahu and Toma-Stoica mark the second time a Romanian man was arrested for ATM cloning in the Denver federal court in two years.
On May 31, 27-year-old Laurentiu Urziceanu, who has a crime record trailing through Europe and the Middle East, was sentenced to five years in prison Wednesday for his role in a credit card cloning scam in Denver.