THE RUNDOWN

Since joining the European Union in 2007, Romanian organized crime groups have become deeply entrenched in other EU countries. Enabled by lax emigration and identification policies by the Romanian state and a common currency with large European economies, the groups have been able to operate with relative freedom. As these groups looked to diversify in both scope and market, unsuspecting tourist locations in the Riviera Maya resort areas of Mexico proved to be fertile ground.

It was this fertile ground which provided Romanian Florian Tudor (known to locals as “El Tiburon” or “The Shark” in English) and a group of ATM-skimming experts with upwards of $1.2 billion dollars. Flush with cash, Tudor’s organization was able to cultivate corruption in the furthest reaches of the Mexican government, as well as foster ventures in his home country of Romania.

Shark-Infested Waters

Prior to the last decade, Romanian Organized Crime operating on a grand scale in the West was a commonly overlooked phenomenon. With the Cold War thaw and the creation of the European Union (EU) in the early 1990s, the idea of nefarious actors in Eastern Europe that were not Russians or former Soviets became a back-burner issue, as all eyes were focused on Ivan.

While the EU was transformational for burgeoning, newly-independent economies in the former Eastern Bloc, it also provided a hotbed for organized crime to rapidly expand to a trans-national scale, with the freedom of movement afforded EU countries and a common currency with larger value on the global markets. With membership in the EU coming to Romania in 2007, this hotbed extended into a country that, according to the Global Organized Crime Index, has one of the largest illegal logging industries in the EU. The Balkans is also known as one of the world’s busiest human trafficking markets, with one of the most notable being a group dubbed the “Tandarei Mafia,” which escaped justice amidst claims of bribery, witness intimidation, and political corruption in 2019. This is the world Florian Tudor found himself growing up amongst, and it would undoubtedly influence him to put nefarious plans in motion.

From Guppy to Maneater

Little is known about Tudor’s early life in Romania; however, sometime prior to 2014 Tudor moved from Romania to the Riviera Maya. The city’s annual average of over 6 million tourists contributed to an almost $95 trillion industry, making it a market that was likely well-acquainted with money-laundering and other scams. Tudor would need help through building an insulated infrastructure, technical knowledge, and clean capital, so he looked to his own hometown of Craiova.

To locate a strong infrastructure in which to better paint his operations as legitimate, Tudor was quick to recruit Adrian Tiugan. The small-time Romanian gang member had put in work for the gang planting skimming devices in ATMs all over Italy, mainly targeting the Vatican. Tiugan’s operations in Italy were put on hiatus in 2012, when he was apprehended by Romanian Organized Crime Investigators. After receiving a suspended sentence for his crimes in Italy, Tiugan decided to skip out of returning to court in Romania to join Tudor in Mexico after forging a passport and work visa in the name of Paul Daniel lonete.

Using the Ionete’s identity, Tiugan set up a shell company in Mexico, Top Life Servicios, which would become the central hub of the entire scam. The stated purpose in the business proposal was to service and operate ATMs in Mexico. To further shore up a legitimate guise to the operation, Tudor also recruited Ion Damian Nedescu. Nedescu was a well-respected businessman from Romania who had fallen on financial hard times. Together, Tiugan and Nedescu began rapid expansion of the business venture, entering into agreements to obtain ATM devices, most notably with Mexican bank, Multiva. Over the course of the scam, Tudor’s organization would amass an estimated 100 ATMs according to investigators.

However, with infrastructure and scalability comes attention. Skimming scams in the past utilized a hard device placed on the exterior of the ATM to capture both the magnetic strip information as well as the PIN information. These devices are usually made to be retrieved after a set period of time, and require physical interaction with the ATM. In a tourist area, where businesses and authorities are keen to find such devices, Tudor knew that he would need to get technical to make the scheme last.

According to the Organized Crime and Corruption Reporting Project (OCCRP), 44-year-old Romanian radio technician Christian Simion was one of those recruited to guide the technical aspect of the scam.

While on the job search in early 2014, Simion came across a job ad in Germany seeking someone familiar with Bluetooth wireless transmission. After applying for the position, he was soon contacted by Cosmin Adrian Nicolae, a now-prominent member of Tudor’s gang who monitored the Top Life ATMs, going to Mexico in spring 2014. After meeting Tudor at his mansion in Novo Cancun and being initiated into the gang, Simion and other technicians were tasked with creating computer chips to implant in the newly-purchased ATMs. These chips would capture card information used in transactions and transmit them via Bluetooth to devices the gang owned.

The Scarface Problem

As the character Frank says in the famous 1983 film Scarface, “…and you’ll find out your biggest problem is not bringing in the stuff, but what to do with all the (expletive) cash,” and after setting up an infrastructure that was generating $240 million a year in non-taxable income for his gang and capturing an estimated 12% of the global skimming market, Tudor was now incredibly cash-rich.

Tudor immediately employed an intricate network of what were referred to as “pullers,” fellow Romanians who wanted to make some quick cash, who were charged with carrying out a global money-laundering plan with the Shark’s money. These pullers would create a tight ledger of when accounts were used in compromised ATMs, along with identifying information to go along with the newly-cloned cards. The pullers would then wait several months before withdrawing up to $200 at a time from ATMs worldwide, with a majority of profits going back into Tudor’s operations. Cards were recorded being used in the United States, Taiwan, and Grenada, with many of the pullers living lavishly on their cut of the laundering operation.

Tudor, Tiugan, and Nedescu also began purchasing real estate in the Riviera Maya through another shell company, Inmobiliaria Investcun, which was in the name of Tudor’s stepbrother, Adrian Enăchescu. Tudor’s gang immediately invested millions of dollars into property in Cancun and other locales around the Quintana Roo state. According to OCCRP, the Mexican notary on Investcun, as well as other Tudor businesses involving property and real estate, was Luis Gabriel Palacios Velasco. Velasco was known for playing part in a scheme known as “Borge’s pirates,” named for the ringleader, Quintana Roo State Governor Roberto Borge Angulo. As part of the scam, Borge, along with other high-ranking Mexican state officials, systematically stole people’s property using state agencies, often auctioning them off to shell companies like Investcun. Borge’s pirates also used a state agency, the Institute of Real Estate Heritage (IPAE) to illegally sell off state-owned land to private buyers. Tudor and his gang would go on to purchase many former IPAE-owned properties, including the gang’s headquarters in Cancun.

The Shark also used this new-found capital to continue to be a menace in his hometown of Craiova. “Florian is the reason for my financial downfall,” Romanian businessman turned state’s witness Raducan Catalin told OCCRP, “I found out that he bought some buildings that I co-owned and I contacted him. He began threatening me. He sent people, they told me to leave.” When Catalin refused, he was corned in Craiova by Tudor’s men, who violently beat him while recording the encounter for Tudor. Soon, Catalin found himself without the properties. Tudor is also linked to several purchases of luxury condos and business parks in Craiova as well.

According to estimates by the Unidad de Inteligencia Financiera, Mexico’s Financial Intelligence Unit, the gang’s total earnings were $23 million in Mexican operations, $24 million in internationally transferred money, and $231 million in check & interbank transfers, totaling roughly $1.2 billion before the scam began to unravel.

The Krebs Exposure

In the early fall of 2015, former Washington Post journalist and highly-regarded security investigator Brian Krebs received a very interesting tip from a technician working for an ATM company in Mexico.

“I heard from an ATM installer in Mexico who said he’d been approached by some Eastern European guys who offered them up to $6,000 a month… The source said these guys had used Bluetooth devices that they implanted inside the ATMS,” Krebs noted in a blog post. Krebs immediately traveled to the Riviera Maya to chase the story, and what he found shocked him—even the ATM in his Cancun hotel lobby had been compromised. Krebs continuously noted the same Bluetooth network on multiple compromised devices, named “Free2Move.”

“I think I found close to two dozen compromised ATMs around those areas…Cozumel, Playa Del Carmen, Tulum…very, very heavy tourist areas.” Krebs elaborated in a later interview.

Krebs went on to publish a three-part expose article on his blog, Krebs on Security, detailing the extent of his trip and findings, which eventually made its way to Tudor. Feeling outed and vulnerable, Tudor contacted one of his top men, Constantin Sorinel Marcu, telling him to shut down the operations.

Tudor circled the wagons, summoning gang members to headquarters in Cancun. A short time later, the gang temporarily pulled chips from approximately 40 devices and were forced to lay low to see what would happen.

Whether through fate or influence, the police never followed up on the Krebs posts, and soon the gang was back to full operations for a full 4 years before any more high-level attention.

The Final Curtain Call

As with most criminal organizations in the past, the unraveling of the Riviera Maya Gang’s empire began with a somewhat haphazard interaction with local authorities.

On March 30, 2019, Tudor and a friend were detained while driving on the Cenotes Route, a fairly well-traveled highway in the Riviera Maya. During the interaction, police discovered that the two were in possession of a Glock handgun (a weapon reserved only for the military under Mexico law), along with in excess of $25,000 in pesos and American dollars. While Tudor and his associate were subsequently released, this began a serious investigation by Mexican authorities into Tudor, culminating in a raid by police and Mexican Marines in May of 2019 of both Top Life’s offices and the gang’s headquarters. Tudor and five of his associates were arrested, but were subsequently released.

Wanting to quickly shift focus away from the gang, Tudor immediately launched a legal and media assault against the Mexican government, even going as far as to file a human rights complaint with authorities. In February of 2020, Tudor went on to publish an open-letter through local media, stating that Quintana Roo’s state police chief, Jesus Alberto Capella Ibarra, was heavily involved in a corruption scheme again Tudor’s operations. Tudor continued to foster claims that Quintana Roo State Police were extorting him, having structured the 2019 raid as a guise to steal jewelry, art, cash, and other items that Tudor claimed to be worth almost $3 million. However, Mexican authorities weren’t buying it. They needed more to bring Tudor into custody.

The break would come in early 2021, as Romania issued an extradition order for Tudor after being charged in absentia for attempted murder, extortion, and founding an organized crime organization. Tudor was subsequently taken into custody on the extradition order by Mexican authorities in May of 2021, and was quickly moved to a maximum security prison at El Altiplano.

While in El Altiplano, Tudor quickly filed an amparo—a legal human rights asylum-style claim under Mexican law—in an effort to stall his extradition to Romania. As of this writing, this effort has been successful in keeping Tudor in Mexican prison and out of the hands of the Romanian government.

THE TAKEAWAY

As Tudor remains in Mexican prison and investigations into the gang continue, the true depth of insulation Tudor was able to create through political corruption is beginning to reveal itself. In December 2022, gang members on trial in Romania revealed new information alleging that the Mexican prosecutor charged with looking into murder charges from the gang, Jonathan Medina Nava, was found to have taken monthly bribes from Tudor totaling $5,000-$6,000. Other high-level prosecutors and state officials have also been relieved of duty due to possible connection to the gang. This corruption has proven a roadblock to prosecution of the gang both in Mexico and in Romania.

While in prison, many of Tudor’s companies continue to operate at full-strength, continuing to bring profits into the gang despite several frozen bank accounts, since only a small number could be directly tied to illicit operations so far by the Mexican and Romanian governments.

Florian Tudor’s Riviera Maya Gang displays the true depth and reach of trans-national organized crime operations coming out of the former Soviet bloc states and fully puts on display the intricacies of the technology being utilized to launder money through these organization.