The trio from Romania went from one ATM to another across the Roanoke Valley and beyond, installing hidden cameras that captured the personal identification numbers of their victims as they punched them into the machines.
At the same time, a skimming device that had been placed inside the ATM recorded the account information from the debit cards, which were then returned to unsuspecting bank customers who went about their business.
After encoding the information onto counterfeit cards, the thieves returned to the ATMs and used the stolen PINs to withdraw cash — more than $250,000 from hundreds of personal banking accounts, according to prosecutors.
This week in Roanoke’s federal court, Marius Catalui, 39, pleaded guilty to bank fraud and aggravated identity theft. He was returned to jail to await a sentencing scheduled for Jan. 7, 2022.
Federal prosecutors say Catalui, a second man and a woman traveled from Romania in late 2018 “solely to conduct ATM skimming activities.” The thefts involved nine banks in the Roanoke, Blacksburg, Martinsville and Lynchburg areas.
Most of the money was taken a few hundred dollars at a time.
While the government is not aware of anyone who suffered a substantial financial hardship, “it takes little thought to imagine the experience hundreds of individuals endured when they realized money had been stolen from their accounts,” Assistant U.S. Attorney Coleman Adams wrote in court documents.
In the spring of 2019, police in multiple jurisdictions were flooded with calls from people who reported unauthorized withdrawals from their accounts. The Roanoke branch of the U.S. Secret Service began an investigation.
A break came May 5 of that year, when a customer at the Bank of Fincastle in Botetourt County — whose wife had been a victim of the skimming — called 911 to report seeing a woman with long black hair and a baseball cap attempting to hide her face as she stood at a drive-thru ATM.
The woman then left in a blue vehicle with New York license plates. The car was later stopped for speeding by a sheriff’s deputy, who saw a small red bag being thrown from the window.
Inside the car, authorities saw a wig of long black hair and a baseball cap. Also recovered was $8,800, most of it in $20 bills, and 46 Panera gift cards that were later determined to have been encoded with stolen bank account information.
Ioana-Christina Pavel and Szilard Farkas, both of Romania, were arrested. Catalui was later charged after surveillance cameras documented him making repeated withdrawals at ATMs, in one case standing at the machine for nearly an hour.
An investigation found that the PINs were captured by small pinhole cameras that were secretly installed near the ATMs. In what authorities called a “sophisticated means” of theft, the skimming devices were placed within the automated teller machines and were not noticeable.
The cameras and skimming equipment were moved from one location to another between December 2018 and May 2019.
In court on Tuesday, Catalui accepted responsibility and expressed “deep remorse,” according to his attorney, Chris Kowalczuk.
Farkas was sentenced earlier this year to the time he had served in jail since his arrest and was ordered to pay $247,566 in restitution to the banks, which for the most part have refunded their clients.
Pavel was released on bond in 2020 and has since been returned to Romania by federal immigration officials. Prosecutors asked that the charges against her be dismissed without prejudice, meaning they could be reinstated in the future.
It was not clear what brought the defendants from Romania to Southwest Virginia.
In a motion to dismiss the charges filed last year, Pavel’s attorney contended that she was the victim of human trafficking by other suspects in the ATM-skimming case.
But U.S. District Judge Michael Urbanski denied the motion, writing in a March opinion that it was “ameliorated” by the subsequent request by prosecutors that the case be dropped, at least for now.