Romanian gang operates millionaire robberies at ATMs in Riviera Maya, Baja, and Puerto Vallarta


In this joint work the research center Organized Crime and Corruption Reporting Project (OCCRP), the Mexican organizations Against Corruption and Impunity, Fifth Element Lab and the Romanian journalism organization without Profit RISE Project, present the story of a group of people of Romanian origin who operate a millionaire business in at least 100 ATMs in Mexico, mainly in the Riviera Maya.

A group of young people from Craiova, a small town nestled in an agricultural region of Romania, learned all they could about banking technology and built an ATM business. They soon operated in Europe, Asia, and America. They invested their profits in new technologies and in skilled labor. They hired smart engineers from the growing Romanian tech sector.

This group of Romanians made a significant investment in Mexico, and the story would be a success if it were not for this group of Romanians being “skimmers,” people who steal bank card information by inserting illegal devices or software into ATMs. Its leader was not a CEO, it was Florian Tudor, a figure in the criminal world nicknamed “The Shark”. And the bigger their business, the more crimes they had to commit to keep it growing: money laundering, intimidation, bribery, and even allegedly murder.

Today, according to police and former gang members, they are one of the world’s largest criminal “skimming” groups, controlling nearly 10% of a $ 2 billion global market.

OCCRP (Organized Crime and Corruption Reporting Project) and its Mexican partners Against Corruption and Impunity and Fifth Element Lab reviewed thousands of documents, interviewed people on three continents, tracked social networks and ordered this puzzle about transnational crime. Despite being seized on more than one occasion, the gang has continued to operate worldwide, with no end in sight of its illicit operations.

Expensive vacation

Rod, a Texan who was enjoying his vacation in the Riviera Maya, was one of the victims of the gang. By going to an ATM, in just 15 minutes, the thieves removed more than $ 800 from their account. He noticed it immediately. He says that he had activated an alert system on his cell phone that notified him of any transaction over $ 250. Thousands of tourists have faced the same problem since 2012 when a group of Romanian-led criminals made Cancun their base of operations. OCCRP nicknamed them “The Riviera Maya Band in Quintana Roo”.

“The shark”

Craiova is the hometown of Florian Tudor, a 43-year-old businessman and, according to Romanian authorities, the leader of “The Riviera Maya Band”. This, according to the police and a former member, has around a thousand members. Several of the city’s newest buildings are investments that come from Tudor’s “skimming” operations, agents say.

However, starting in January 2020, the Romanian police began investigating him for leading an organized crime group. The Mexican police also have him in their sights. The Romanian Directorate for Organized Crime and Terrorism Investigation (DIICOT, Romanian acronym) alleges that Tudor ordered that they threaten, beat, blackmail, and murder enemies including ex-members with whom they were displeased.

Tudor, who is still based in Mexico, denies these allegations. “I am not a criminal and I never will be,” Tudor said in an email exchange with OCCRP: “I have never killed anyone and I have never ordered anyone killed.” He claims that he is a legal businessman, a victim of corrupt authorities in Romania and Mexico, bribed by criminals. Also, he accuses the Mexican police of having robbed him, and points out that OCCRP reporters are allies of these corrupt authorities.

From Craiova to Cancun

Before 2014, Tudor moved to the Riviera Maya, where he is known as “El Tiburón”. Several Craiova compatriots followed in his footsteps. One of them was Adrián Tiugan, 36, a petty thug who called himself “Mufa” or “El Jack” and who already had a criminal record in Italy and the Vatican since in 2012 the authorities sentenced him to two years and half a prison for tampering with ATMs. In December 2013, Tiugan appeared at the Cancun business registration offices to create Top Life Servicios, whose purpose was to serve and operate ATMs in Mexico.

Tiugan registered the companies under the name of Paul Daniel Ionete, a Romanian from Craiova known to the band members. To prove his identity, Tiugan used a Mexican residence permit and a forged Romanian temporary passport, which bore Tiugan’s photo and Ionete’s name. This document shows the validity of five years, although Romanian temporary passports are only valid for one year. There is no evidence that Tiugan has had problems with local authorities. Despite the false passport and that Romania issued an international arrest warrant. In an email to OCCRP, Tudor contested the fact, arguing that he, his brother, and his associates do not use false identities because “we have nothing to hide.”

The band’s “skimmers” and fundraisers operated as far afield as Indonesia, India, Barbados, Granada, Paraguay, Brazil, Japan, South Korea, and Taiwan.

Adrián Enachescu, 33, Tudor’s stepbrother, followed him to Cancun in 2015 and became a shareholder in Top Life with Tiugan. Tudor also attracted Ion Damián Nedescu, 49, a businessman and philanthropist from the Romanian port city of Constanta. Nedescu was a successful businessman, who had fallen into financial difficulties. It is unclear how they met, although Nedescu’s girlfriend at the time was from Craiova and could have introduced them.

Nedescu was known in Romania for his inspiring story for the efforts he made to help his son and other children with autism. In February 2014, Nedescu took 20% of the shares in Top Life and became a representative of the company. Court records known to OCCRP show that the gang started buying Chinese ATMs, including from the Triton and Hyosung brands.

Triton — Nelson Mobile Banking
Triton ATMs

What they did was hack their processors and install their own software, custom-designed to capture bank card data. Enachescu became involved with other companies led by the band, including Intaller who bought and sold new and used ATMs.

But “The Riviera Maya Band” did not stop there. In 2014 they reached an agreement with Multiva, a respected Mexican bank. The ATMs that belonged to Top Life would go with the logo of the financial institution. By 2017, Top Life operated more than 100 ATMs with the Multiva brand throughout the Riviera Maya and in other tourist sites in Mexico.

Banco Multiva vende negocio de seguros a BX+ • Forbes México

A former member of the gang, who became a witness for the Romanian prosecution, described in a statement signed in March 2019, how Top Life Services worked: “We control around 100 ATMs with chips installed in them … On average, each machine copied about a thousand cards each month. We withdrew about $ 200 from each of these cards, $ 20 million withdrawn each month. “

Puerto Vallarta Mayor Making Improvements to Downtown Area
Puerto Vallarta Malecon

He recalled that they had 20 ATMs in Puerto Vallarta, four in Baja California, 24 on the island of Cozumel, 30 in Playa del Carmen, five in Tulum, and three in the Las Américas shopping center in Cancun. Top Life Servicios ended up generating income of $ 240 million annually, tax-free. That made “La banda de la Riviera Maya” the controller of one of the largest skimming operations in the world, with about 10% of the global total managed by its members. The former member of the gang said that the organization grew to some 1,000 members, with a nucleus of about 50 people close to Florian Tudor.

Los Cabos

To manage those benefits, the band created Investcun Real Estate in 2015, in charge of Enachescu, Tudor’s stepbrother. The company invested millions of the group in properties in Mexico. The gang built their headquarters, an imposing multi-story mansion with rooftop pools and elevators, on land that Investcun purchased in a prime area of ​​Cancun. For 2019, the company was also involved in the development of a residential and golf project in Puerto Morelos, a tourist destination between Cancun and Playa del Carmen.

Other Mexican companies controlled by Enachescu include Mexrou, an import and export company; Alto Mundo, a gym and sportswear company; Intacarrent, which rents and repairs vehicles, and Brazil Money Exchange, which has offices throughout the Riviera Maya.

“El Tiburón” was a shareholder in Intacarrent and Brazil Money Exchange and had power of attorney over Inmobiliaria Investcun. He was also an administrator for Europe Invest, another Cancun-based company he used for real estate investments.

Organized Crime and Corruption Reporting Project (OCCRP) also asked Nedescu for his version, who said he could not answer the questions, as there is an ongoing investigation into the Tudor organization: “Until the investigations by the competent bodies are finished, I will allow not to express my opinion. Thank you for your understanding, “he said.

Unwanted attention

The Riviera Maya band received unwanted attention in September 2015. American journalist Brian Krebs published a story about his business. Krebs’ source told him about Bluetooth and skimming devices that Cristian Simion, a Romanian technician hired to work for the band (and who is currently a protected witness) manufactured.

Krebs verified when visiting Cancun how these skimming systems operated. When he published the story, Florian Tudor was furious and contacted Constantin Sorinel Marcu, one of his men, with the Viber application and ordered him to close all operations. Marcu was one of El Tiburon’s trusted men. This commissioned Marcu to guarantee the security of the Top Life ATMs, especially in Playa del Carmen. In Romania the Shark and Marcu

they had a very close relationship. Rebeca Tudor, the Romanian wife of the Shark, was godmother to Marcu’s daughter and families saw each other regularly. Videos obtained by OCCRP show the Shark celebrating Marcu’s birthday in a club. The two men toast and wiggle to the rhythm of Romanian music. Another video shows Marcu on the birthday of one of the Shark’s children.

However, a year after Marcu joined the Shark in Mexico, some tensions began to emerge. Members of the gang who are now witnesses noted that Tudor was envious of Marcu’s success with women. And Marcu was not satisfied with the share of the skimming business he received. Then things got even uglier.

A series of cell phone screenshots, obtained from criminal files, show Marcu and Tudor exchanging insults in May 2015.

The Shark signaled to the gang members to cut ties with Marcu. On April 2, 2018, four thugs attacked Marcu, in front of a DHL office in Cancun. Marcu’s spleen was then removed at a local hospital. In Romania, the Shark and the four attackers were charged with attempted murder.

Marcu could never take revenge. Two months later, on June 11, he was shot in the head.

The Mexican police

Tudor was now in the crosshairs of the Mexican authorities. In May 2019, the police and the Navy made separate entries and searches both at Top Life headquarters and at Tudor’s house in Cancun. Tudor and five of his collaborators were detained, although soon after they were released. Tudor reported that the true goal of the police operation was to steal $ 2.7 million worth of jewelry, art, cash, and computer equipment.

But he countered quickly. Tudor launched a legal battle the months after the searches. He filed several injunctions, arguing that his human rights had been violated. In February 2020, Tudor and two of his collaborators published an open two-page letter in a Mexican newspaper against the Quintana Roo State Security Secretary, Jesús Alberto Capella Ibarra. They accused him of extorting them.

The records were Tudor’s second run-in with the law that spring. Six weeks earlier, on March 30, he, along with his friend and right-hand man, Nicolae, were detained while driving on the road known as the Ruta de los Cenotes. On March 16, the Shark hosted a press conference at his Cancun home in which he insisted that he is a law-abiding businessman who had become the target of unscrupulous police, journalists, and criminals.

He claimed that he met Marcu and his brother at a restaurant in Cancun, where they introduced themselves and asked him for a job. Tudor maintained that, since 2015, Marcu and his people have tried to extort and blackmail him. According to the Shark, Marcu threatened him with death after he refused to involve his legal business in a plot of cloned cards. He claimed that Marcu not only gave Krebs false information, but even paid him to publish his investigation. He noted that Krebs’ story was the start of a “smear campaign” that destroyed years of hard work and led to him losing his contract with Multiva.

He added that the authorities were in the pay of Marcu’s gang, including Capella, who wanted him dead. He denounced that the police placed the weapons to justify his arrests, that agents threatened to rape his wife and to leave his six-year-old son – who was pointed a pistol at his head – orphaned. He provided no evidence of those allegations.

Capella, the police chief, responded to those attacks on Twitter, denouncing “a perverse media campaign orchestrated and financed by obscure interests.” The Quintana Roo Public Security Secretariat stated that Tudor’s complaints against Capella were primarily an attempt to obstruct ongoing investigations against him and his organization.

In Romania, five of the Shark’s top collaborators were arrested and Tudor himself is under investigation for the assassination attempt on his old friend Marcu. 


The Mazatlan Post