By Aja Reed
Assistant Criminal District Attorney in Dallas County
During an open plea on a case involving Romanian defendants who placed credit card skimmers and pin-hole cameras around Dallas County, I argued to the judge, “It’s a modern-day bank robbery, but instead of stealing from banks, they are stealing from everyday people—783 people.”
In July 2025, I got a call from Special Agent Jerry Alvarez with the Texas Financial Crimes Intelligence Center (Texas FCIC). Agents there were following another group of Romanian skimmers. I had previously handled a case involving a similar group, so he wanted to give me a heads-up that they had another one under surveillance.
Like the group before them, these criminals were placing skimmers and pin-hole cameras at ATMs inside several CVS and Walgreens locations throughout South Dallas. A manager at Walgreens noticed the skimmer inside one of the ATMs and, having worked with Special Agent Alvarez in the past, called him to come out and take a look.
Once there, Texas FCIC agents secured the ATM and began reviewing surveillance videos to determine who had placed it there. They discovered that the day before, a man had been standing by the ATM, pulled the pin-hole camera out of his shorts and secured it onto the machine. Using the store’s closed-circuit footage and security videos from surrounding businesses, investigators identified the vehicle the three suspects arrived in. It was parked two businesses over.
The following day, the vehicle was located near a CVS. After the suspects left the store, Texas FCIC agents went inside. They did not locate a skimmer but found glue residue on the ATM left behind from the placement and removal of a pin-hole camera. After a day of surveillance, the three suspects were arrested and their Airbnb searched.
This was my second group of Romanians involved in skimming cases and there is a third group I’m dealing with now. I also had prior interactions with a fourth Romanian group the year before that involved Sam’s Club and the theft of almost $700,000 in food stamps. I’m not sure why the Dallas–Fort Worth area is being hit so hard by Romanian credit card skimmers, but I know from working with Texas FCIC that the problem isn’t limited to Dallas. They are hitting other major cities in Texas and across the nation.
Skimmers and how they work
There are two basic types of skimming devices. The first is what is referred to as a deep-insert skimmer. It is thinner than a credit card and is inserted into the ATM card slot. Once a customer enters a debit card, the deep-insert skimmer records the bank account information. These devices work in conjunction with a pin-hole camera. It is the smallest camera you can imagine, about the size of the tip of a pin. It is attached to the ATM and records unsuspecting victims as they type in their PINs (personal identification numbers).
Once the skimmer has been in place for a couple of days, both devices are removed from the ATM and the data is downloaded onto a laptop. The suspects then match up the timing of the card swipe with the entry of the PIN. Once they have a match, they re-encode another card—typically a stolen gift card—with the account data using a re-encoding machine and a laptop. They then write the PIN on a small sticky note attached to the gift card because the cards are used repeatedly.
The other type of skimmer is called an overlay. This larger device fits over the front of the ATM. I’ve also had cases in which the overlay was placed directly onto the point-of-sale terminal at a small grocery store. The overlay records the data as customers swipe their debit cards, but it doesn’t require a pin-hole camera because it records the PIN as it’s typed in. The overlay is then removed, the data is downloaded onto a laptop, and it’s then re-encoded onto gift cards.
Once criminals have your account information and PIN, they can drain your bank account, the amount of which is limited only by your bank’s daily withdrawal limit. Texas FCIC has found that these groups aren’t just targeting debit cards. They are also stealing food stamp benefits using the same methods.
How the Romanians work
The Romanians follow a general timeline. When they arrive in a new city, they rent out an Airbnb. They ship their equipment and supplies to the city rather than risk getting pulled over while transporting them in a vehicle. They usually have multiple types of skimmers designed to fit different types of ATMs. In fact, this group had a skimmer labeled Buc-ee’s.
Once they are set up, they spend a couple of days conducting surveillance to determine the best ATM locations, which size skimmer they will need, the best place to park, and other logistical details. Then they install the skimmers and pin-hole cameras. They periodically go back and check on their skimmers to make sure they haven’t been removed. They then remove them, download the data, and install additional skimmers. They continue this process for a week or two.
Then comes the cash-out phase. The cash-out will be done quickly, typically within two or three days, before banks detect any fraud and while the criminals can still withdraw as much cash as possible. At the same time, they pack up the equipment and get it ready to ship to the next city. They will stay in one location for only about three weeks. In my prior case, the group had operated in Dallas, California, Kansas, and then returned to Dallas. This is one reason these groups are so difficult to catch—they move quickly, they are highly transient, and they abandon belongings at the first sign of trouble.
Romanian vs. Romani
There is a distinction between Romanian organized criminal groups and organized criminal groups made up of Romani families. Although both may originate from Romania and may have connections to Romania, they are not necessarily part of the same criminal organization or network.
In our experience, some of the Romani organized criminal groups operate more like traditional family-based organized crime organizations. The criminal activity is often centered on extended families, with different members taking on different roles and generating money for the family. Leadership and influence can remain within the family, with older generations grooming younger ones to continue the criminal enterprise. Some groups also maintain their own internal criminal resolution or customary judicial practices rather than relying exclusively on the formal government system.
These groups can operate in relatively small, independent cells or family groups throughout the United States. They may have relationships with other families or criminal groups in Romania and may send proceeds back to Romania while still maintaining family members and an active criminal presence in the United States.
That is different from simply saying that all the Romanian groups are connected. In the particular investigation in this article, we identified this group as a Romanian organized criminal group, separate from the traditional family-based Romani organized crime groups. At this time, we have not identified a direct organizational connection between this group and the other Romanian or Romani groups that we have pros- ecuted or are currently prosecuting. The fact that these groups are Romanian or originate from the same general region does not, by itself, establish that they are connected.
Back to my case
When Texas FCIC finally arrested the three suspects, officers executed a search warrant on the Airbnb. What they found was astonishing: $32,700 in cash; 237 re-encoded gift cards; SD cards containing victims’ card numbers; ATM skimming parts to construct a total of 115 skimmers; 71 pin-hole cameras; six PIN pad overlays; materials to build skimmers as well as the tools to remove them; two re-encoding machines; 25 fraudulent passports and international IDs; laptops; and several cell phones.
One of the biggest challenges after the arrest was determining the suspects’ true identities because they possessed so many fraudulent passports and international IDs. They were finally identified as Gheorge Ciprian Hilitanu, Victor Tecu, and Ionut Firan Alexandrau, all from Romania. They had no prior criminal history.
I charged each of them with engaging in organized criminal activity, unlawful use of a wire or electronic communication, fraudulent use or possession of more than 50 credit or debit cards, and tampering with a government record (for all the fake international IDs and passports).
Once Texas FCIC had everything analyzed, it was determined there were 783 unique stolen victim accounts. Seven hundred eighty-three individual victims. It wasn’t possible to calculate the total financial loss, but we knew exactly how many people had been victimized simply because they had used an ATM.
An open guilty plea
Hilitanu elected to go open on punishment because he rejected my offer of 20 years in prison. During the open plea, I called Special Agent Alvarez to educate the judge on how skimmers work. Using demonstrative videos, I highlighted the ease with which these devices can be placed and the clarity of the videos from the pinhole cameras. I also played the surveillance videos from the stores showing each of the defendants pulling cash out of the ATMs. By the time they were arrested, they were in the midst of the cash-out phase and were boxing up their equipment to move on to the next city. We had caught them just in time.
When it came time for closing arguments, the sheer number of devices was compelling evidence. But the most powerful evidence was the number of victims: 783.
In handing down her sentence, the judge said that while each withdrawal may have been only $200, the maximum at most ATMs, it could have a huge financial ripple effect on each victim’s life. She noted that anyone can become a victim of this type of crime. She sentenced Hilitanu to 30 years on the engaging and fraudulent use charges and 20 years on the tampering and the unlawful use of electronic communication charges.
Following Hilitanu’s open plea, the other two defendants accepted the State’s offer of 20 years apiece.
Help for future cases
One reason this prosecution was successful was the close working relationship our office has developed with the Texas Financial Crimes Intelligence Center. As financial crimes continue to grow in complexity, prosecutors and investigators increasingly rely on specialized resources. The Texas FCIC has become an invaluable partner by providing experienced special agents who understand the sophisticated methods used by today’s financial criminals. The agency continues to expand across Texas, and every special agent is a licensed peace officer with extensive experience investigating complex financial crime schemes.
The Texas FCIC’s mission extends well beyond conducting investigations. The agency works alongside local law enforcement by providing investigative assistance, technical expertise, and training on emerging financial crime trends. Its special agents routinely assist with cases involving ATM skimming, ATM jackpotting, point-of-sale skimming, gas pump skimming, business email compromise (BEC), money laundering, cryptocurrency-related offenses, tap-to-pay fraud, gift card fraud, and organized criminal enterprises that exploit elderly victims for financial gain. These investigations often span multiple jurisdictions; involve intricate, hard-to-trace schemes; and require extensive analysis to identify the individuals responsible.
Just as important, the Texas FCIC serves as a key resource for prosecutors. Financial crime cases can be difficult to present to a jury because of the volume of records and the intricacy of the underlying scheme. Texas FCIC assists prosecutors in organizing evidence, tracing the movement of funds, and translating complicated financial schemes into presentations that juries can understand. Its support allows prosecutors to focus on proving the elements of the offense while ensuring the jury can clearly follow the crime from beginning to end.
Skimming cases are not difficult to prove, but the perpetrators are difficult to catch. These groups are sophisticated and move quickly. Groups have moved through Dallas without us knowing they were here until abandoned skimmers were discovered in ATMs or other targeted machines.
If you get one of these cases, it is important to work closely with both the merchant and the investigating law enforcement agency. Stores are highly motivated to assist because these crimes affect their customers. Everyone involved has an interest in protecting the public. The surveillance videos will be among your strongest pieces of evidence. You should also be prepared to educate the judge or jury on how skimmer devices and pin-hole cameras work because most people have no idea how easily these crimes can be committed.
Most importantly, emphasize that this crime can happen to anyone. There are a few things consumers can do to protect themselves:
• use tap to pay or a digital wallet;
• if you cannot tap to pay, use the chip reader rather than swiping the card;
• use credit cards rather than debit cards, as credit cards offer better fraud protection;
• monitor your bank accounts;
• when withdrawing cash from an ATM, shield your hand while typing in your PIN; and
• rather than using an ATM to withdraw cash from your account, go inside the bank to see a teller. (For more information on how to protect yourself, please visit https://fcic.texas.gov/con-sumer.)
For these criminal groups, it is a low-risk crime with a high payoff. It’s certainly easier than robbing a bank.