Federal records lay out what investigators say was a long-running, transnational crew of Romanian scammers quietly draining public food-assistance benefits from San Diego County families over multiple years. The group allegedly planted slim overlay skimmers and tiny hidden cameras on checkout terminals and ATMs to capture EBT card numbers and PINs, then loaded that stolen data onto blank cards for cash withdrawals. Many of the victims were low-income households relying on CalFresh and related programs, only to find their monthly benefits gone.
A federal search warrant unsealed this week names four people tied to the operation and says two of them were arrested in Los Angeles in late October. As reported by CBS 8, the warrant identifies Dorin Mirel Mihailescu (also known as "Stefan Holub"), Vasile Liviu Ardelianu, Aurelian Cornel Bucur and Carmen Mihaela Paraschiv, and describes episodes from 2022 through 2025, including a September 2022 attempt to pull nearly $15,000 from 19 victims’ accounts, with more than $9,600 successfully taken. Investigators also trace bank deposits and spending that they say funded an itinerant, cash-heavy lifestyle for people linked to the ring.
How investigators say the ring worked
Prosecutors and agents outline a now-familiar playbook: overlay or "plug-on" skimmers snapped onto point-of-sale terminals, paired with ultra-thin cameras tucked near ATM slots to capture card data and PINs. The stolen information was allegedly re-encoded onto gift cards or other blank plastic, which were then used for withdrawals. Federal prosecutions across Southern California have repeatedly documented the same tactics and the same flow of cloned cards and harvested account numbers as evidence in court, according to the U.S. Attorney's Office, Central District of California.
As outlined by the U.S. Attorney's Office, Central District of California, agents in other skimming cases have seized gear and cloned cards, then used bank records and data from seized devices to track specific withdrawals and shipments of goods purchased with stolen benefits.
Evidence, cash and a regional pattern
Court filings in the San Diego case and related investigations describe bank deposits and payments for Airbnbs, hotels and rental cars that investigators say line up with proceeds from benefit theft. Federal actions across the region have turned up a similar signature: cloned cards, skimming hardware and stacks of counterfeit cards recovered during coordinated sweeps.
Local coverage of Orange County's EBT skimming crackdown - which recovered hundreds of cloned cards and six-figure sums - illustrates how these networks have operated across Southern California. Those statewide operations and federal press releases also underscore that the typical victims are the lowest-income households, with monthly benefits meant for basics like groceries and baby formula. Federal prosecutors in the Southern District of California and local outlets have documented similar rings that targeted public-assistance cards.
Court records and past prosecutions
One of the central figures named in the San Diego warrant, Dorin Mirel Mihailescu, had already surfaced in federal court and was ordered detained on a related complaint, according to court filings. According to Casemine, court records from the Central District of California show Mihailescu made an initial appearance in October 2024 on access-device and skimming-related allegations.
Elsewhere in California, federal prosecutors have secured guilty pleas and prison terms in similar EBT-skimming prosecutions, reinforcing what they describe as a pattern tying transnational groups to the theft of public benefits. Recent sentencing records in Los Angeles from the U.S. Attorney's Office, Central District of California describe tens of thousands of stolen access numbers and elaborate skimming operations.
Legal next steps and advice for victims
The search warrant, reported by CBS 8, says investigators are asking a judge for access to suspects’ laptops and phones to look for data that could identify more victims and tally losses. Device data has been key in earlier cases to connect cloned cards with specific withdrawals and purchases.
Prosecutors typically use federal access-device-fraud statutes along with related forfeiture counts, and prior Southern California cases show those laws can bring substantial prison time and fines. Filings from the U.S. Attorney's Office, Southern District of California list the statutes and potential penalties used in comparable prosecutions.
Where to report suspected EBT theft
If you suspect your CalFresh or other EBT benefits were stolen, San Diego County's Health & Human Services Agency offers guidance, a reporting form for electronic benefit theft and contact information for assistance. The county's EBT fraud page details how to report losses and find support for affected households.
The federal probe in San Diego is ongoing, and investigators say they expect to update charges as more evidence comes in. Anyone with surveillance video, receipts or other information tied to suspicious ATM or checkout activity is urged to contact local law enforcement.
