A Romanian national with 23 aliases has been arrested in connection with a bank ATM shimming operation that resulted in more than 100 Oklahomans losing a combined $100,000 through fraudulent charges and withdrawals.
An arrest warrant was issued Thursday for Iancu Ovidiu Florea following a U.S. Secret Service investigation into ATM shimming at Tinker Federal Credit Union branch locations in the Tulsa and Oklahoma City areas.
A federal criminal complaint issued Thursday accuses Florea, who was also wanted internationally, of bank fraud, conspiracy to commit bank fraud, aggravated identity theft and conspiracy to commit aggravated identity theft.
“Florea and his group of foreign nationals allegedly used sophisticated electronic equipment to illegally capture credit union customer account information at ATM machines,” U.S. Attorney Trent Shores said.
“They then allegedly used that account information to withdraw thousands of dollars at ATMs located hundreds of miles away,” Shores said.
Investigators think Florea’s real name is Iancu Jianu and that he is a 51-year-old Romanian who recently had been traveling the U.S. on a stolen Belgian passport, according to an affidavit filed in support of the criminal complaint and arrest warrant.
Jianu was identified by investigators as one of three people seen on surveillance cameras installing and removing shimming devices and pinhole cameras on four Tinker Federal Credit Union branch ATMs between July 21 and Aug. 3.
One of the devices used to steal debit card information was installed at the Tinker Credit Union branch at 8920 E. 61st St., records show.
The affidavit describes a shimmer as an electronic device that is secretly installed on ATMs to capture customer account data when their cards are inserted into the ATM.
Pinhole cameras are installed covertly on ATMs to capture the card’s personal identification numbers as they are entered by customers, according to the affidavit.
Customer account data and PINs are collected later by the installers who use the information to conduct illegal account transactions, typically cash withdrawals at remote ATM locations.
A task force was formed Aug. 5 to investigate the illegal Tinker ATM transactions after a shimmer was discovered on an ATM at the credit union’s Yukon branch, according to the affidavit.
Shimmers and pinhole cameras were also discovered over the next two days at branch locations in south Oklahoma City, Moore and Tulsa.
Tinker Credit Union officials discovered that three people had been involved with the installation and removal of the unauthorized devices between July 21 and Aug. 3 at the four branch locations.
Credit union surveillance videos captured one of the people, later identified as Jianu, inspecting the drive-thru ATM machine at the Tulsa location on East 61st Street and conducting what appeared to be a test transaction on July 28, according to the affidavit.
Three days later, a person believed to be Jianu was seen on surveillance video inserting a white card into the Tulsa branch ATM and then removing the pinhole camera and the white card before walking away.
Two small black shimmers were found on the Tulsa ATM on Aug. 6. They were identical to similar devices removed Aug. 2 and Aug. 5 from Tinker Federal ATMs in Oklahoma City.
“Over a hundred customer accounts were affected, and many of those belonged to senior citizens,” Shores said. “It is imperative for far-flung criminal fraud such as this to be prosecuted in federal court, especially when it affects those at a vulnerable phase of their financial lives.”
Authorities caught a break in the investigation when an ATM security camera in Albuquerque, New Mexico, recorded a fraudulent cash withdrawal and one of the suspects, identified only as “M.M.”
The security camera also recorded the license tag of a rented Toyota driven by M.M. The vehicle was returned to a rental agency in Las Vegas on Aug. 12, where a Mercedes was rented by a man later identified as Jianu, according to the affidavit.
Investigators tracked Jianu’s movements in August via the internal global positioning satellite system in the rented Mercedes he was driving from Las Vegas to the Chicago area, where he was arrested on an outstanding federal warrant issued in Michigan, according to the affidavit completed by U.S. Secret Service Special Agent William A. Wind.
When stopped, the driver produced a Belgian passport that was believed to have been lost or stolen in June. A check of the driver’s fingerprints revealed that he was wanted for similar crimes dating back to 2009 in Michigan under the name Iancu Oviduu Florea.
Investigators used the United Kingdom police system to determine that the man was Jianu, who was sought by Interpol for unspecified crimes.
Belgian authorities have also issued an alert for Jianu for unspecified crimes, and Romanian officials are seeking to extradite him for “economic and financial offences.”
Records show that Jianu made an initial appearance Sept. 12 before a magistrate in U.S. District Court for the Eastern District of Michigan, where he is being prosecuted under the name Iancu Ovidiu Florea. He is being held without bond on the Michigan charges, an 11-count indictment that alleges he and two others participated in a scheme that caused the loss of nearly $680,000 from customer bank accounts, records show.
The Michigan indictment alleges that emails purporting to come from the Better Business Bureau, U.S. Internal Revenue Service or the U.S. Department of Justice were sent to Comerica Bank account holders.
The emails contained malware that was installed when an attachment was opened. The malware recorded the keystrokes on the user’s computer and sent that information to the email sender. The collected information — account usernames, passwords and other information — was then used to access customer accounts.