Federal records lay out what investigators say was a long-running, transnational crew of Romanian scammers quietly draining public food-assistance benefits from San Diego County families over multiple years. The group allegedly planted slim overlay skimmers and tiny hidden cameras on checkout terminals and ATMs to capture EBT card numbers and PINs, then loaded that stolen data onto blank cards for cash withdrawals. Many of the victims were low-income households relying on CalFresh and related programs, only to find their monthly benefits gone.
A federal search warrant unsealed this week names four people tied to the operation and says two of them were arrested in Los Angeles in late October. As reported by CBS 8, the warrant identifies Dorin Mirel Mihailescu (also known as “Stefan Holub”), Vasile Liviu Ardelianu, Aurelian Cornel Bucur and Carmen Mihaela Paraschiv, and describes episodes from 2022 through 2025, including a September 2022 attempt to pull nearly $15,000 from 19 victims’ accounts, with more than $9,600 successfully taken. Investigators also trace bank deposits and spending that they say funded an itinerant, cash-heavy lifestyle for people linked to the ring.
How investigators say the ring worked
Prosecutors and agents outline a now-familiar playbook: overlay or “plug-on” skimmers snapped onto point-of-sale terminals, paired with ultra-thin cameras tucked near ATM slots to capture card data and PINs. The stolen information was allegedly re-encoded onto gift cards or other blank plastic, which were then used for withdrawals. Federal prosecutions across Southern California have repeatedly documented the same tactics and the same flow of cloned cards and harvested account numbers as evidence in court, according to the U.S. Attorney’s Office, Central District of California.
As outlined by the U.S. Attorney’s Office, Central District of California, agents in other skimming cases have seized gear and cloned cards, then used bank records and data from seized devices to track specific withdrawals and shipments of goods purchased with stolen benefits.
Evidence, cash and a regional pattern
Court filings in the San Diego case and related investigations describe bank deposits and payments for Airbnbs, hotels and rental cars that investigators say line up with proceeds from benefit theft. Federal actions across the region have turned up a similar signature: cloned cards, skimming hardware and stacks of counterfeit cards recovered during coordinated sweeps…