What looked like a routine stop at a Villa Park ATM turned into the centerpiece of a months-long investigation, after deputies say a slick cash-drop distraction let thieves quietly swap a victim's debit card and walk away with his PIN. Three people have now been arrested in Orange County, and investigators say the coordinated scheme appears to be tied to similar thefts in multiple California counties.
According to the Orange County Sheriff's Department, the case kicked off when a 66-year-old man used an outdoor ATM in the 17000 block of Santiago Boulevard on Nov. 18 and later discovered his card had been compromised. Surveillance video, the department said, showed one suspect watching as the customer entered his PIN, a second suspect dropping cash at the man's feet to pull his attention away, and a third quietly swapping his debit card for a fraudulent one. Deputies said they tracked a gray SUV seen in the footage, obtained search warrants, and on Jan. 6 arrested three Romanian nationals.
The suspects were identified as Romita Achitei, 61, Paul Agafitei, 43, and George Asafiei, 46, and are facing multiple felony counts that include grand theft, identity theft, and forgery, as reported by NBC Los Angeles. Investigators with the Sheriff's Office say they have linked the trio to at least a dozen victims in Orange, Los Angeles, San Bernardino, San Francisco, and Sacramento counties. Prosecutors have not yet announced formal filings, and deputies say the investigation is still unfolding.
How this fits a broader pattern
Crimes that harvest card data through distraction or skimming are hardly new, and federal prosecutors have taken down similar operations in recent years. A U.S. Attorney's Office press release describing a 2025 case in which a Romanian national was sentenced for bank fraud and aggravated identity theft shows how criminal rings can use skimmers, cloned cards or distraction tactics to turn stolen account data into fast cash, according to the U.S. Department of Justice. Those federal cases highlight that the tools and players may change, but tracing the money often requires cooperation across jurisdictions.
How the distraction works and how to avoid it
The Orange County Sheriff's Department has warned that suspects typically trail victims into parking lots, drop cash near them and insist the money belongs to the victim in order to create a brief but crucial distraction, as reported by NBC Los Angeles. While the victim looks down or bends to pick up the bills, someone else can step in to swap cards or peek at the keypad. Deputies urge customers to cover the keypad while entering a PIN and to avoid engaging with strangers during ATM transactions. "If someone approaches you, make sure to keep your distance and do not allow any stranger within arm's reach," the department advised.
Charges, reporting and next steps
The Orange County Sheriff's Department says the three suspects are booked on multiple felony counts, including grand theft, identity theft and forgery, and that investigators believe there may be additional victims, according to the department. Anyone who thinks they may have been targeted in a similar distraction theft is asked to call the OC Sheriff's tip line at 714-647-7000. Deputies say the investigation is active and that they are working with other counties to identify more victims and track suspect transactions.
