A light snow was falling in Craiova, southern Romania, when Sorin Velcu called his mother in December 2018 to ask for 20,000 euros he had given her for safekeeping. But the funds were frozen — buried in the ice-cold earth in her backyard.
“Somebody has to dig it out,” Paula Velcu told her son, according to records of the conversation submitted to the court by Romanian prosecutors, who allege that Sorin Velcu belongs to a transnational organized crime group.
The cash was only a fraction of the money the gang had stashed around the world. Led by Florian Tudor, also known as “The Shark,” the organization specialized in stealing banking information from rigged ATMs and withdrawing cash from the accounts of victims.
While Tudor and other key members hailed from Craiova, they ran their scheme in countries including Indonesia, Mexico, and the Caribbean island nations of Barbados and Grenada. The Shark based his operation in the Mayan Riviera region of Mexico’s Yucatan peninsula, where he preyed on the millions of tourists who visit each year.
The scam brought in an estimated US$240 million a year from early 2014 until spring 2019 — totaling around $1.2 billion, according to one former gang member.
It was a complicated operation. Tudor’s Riviera Maya gang loaded victims’ stolen account details onto cloned bank cards, which they used to withdraw small amounts at a time in various locations around the world. The bundles of cash had to be gathered together, and then laundered to create the impression that the profits were from legitimate businesses.
Journalists traced the trail of this cash, which was sometimes carried personally from place to place or transferred using companies like Western Union. Some of the money was invested in real estate.
To uncover the money laundering scheme, journalists searched property records on four continents, interviewed dozens of sources, and delved into around 15,000 pages of law enforcement documents from Mexico, Romania, Indonesia, and the United States.
Velcu is now awaiting trial in Romania, where authorities charged him in January for belonging to an organized crime group, extortion, and possession of a firearm. Five other gang members were also charged. The Shark remains free in Mexico, where he is under investigation on unknown charges.
Velcu had been jailed at least once before, for seven months in Indonesia, where he was sentenced along with three fellow gang members. They were found with cards cloned from victims from 10 countries in Europe and North America.
Velcu and his crew — including his partner, Alisa Sardaru — were caught in March 2019 on the Indonesian island of Bali during one of their money-collecting trips. They would travel the world, visiting different ATMs to withdraw from their victims’ accounts. To avoid detection, they took out only small amounts at a time.
From far-flung countries, Velcu and his crew would find people to make Western Union transfers to Romania. The money would be sent to others back in Romania including locals in Craiova recruited by gang members and The Shark’s wife, Rebeca Tudor. Romanian prosecutors found numerous individuals from Craiova, including construction workers, a student, and even a priest, who picked up amounts of $3,000 or less, according to their statements.
Eduard Costel Raicea, 28, told prosecutors he was working on a house being built by Rebeca when she approached him and around 10 of his co-workers and requested a favor.
“She asked us to receive some money from Mexico via Western Union from her husband, as the amount was a larger sum of money that she could not withdraw, she needed the money to finish building the house,” he told prosecutors.
Rebeca gave them each a piece of paper with a Money Transfer Control Number and they picked up amounts of between 2,800 and 3,000 euros, he said. For their trouble, they each received 100 Romanian lei (about 20 euros).
By transferring relatively small amounts of cash, and using different people to do so, the gang could avoid scrutiny for money laundering. Nonetheless, the Financial Intelligence Unit of Romania picked up the suspicious transactions and notified the police in 2016.
The gang also hid cash in packages sent via DHL, or simply carried the money on international flights hidden in their clothes, according to Romanian police.
In February 2019, Maria Dumitru, originally from Romania, was stopped at the airport in Cancún on her way from Panama, carrying 80,000 Barbados dollars (about $40,000). She told Mexician law enforcement that she made between $15 and $26 a day cleaning houses on the street where the Riviera Maya gang had real estate. She said she had received the money from a rich person from the “Arab country of Israel,” whom she had met online.
She told authorities she was hiding the money because her husband was the jealous type and did not know about her online infidelity.
In fact, her husband was Gheorghe Dumitru, who Mexican police say is a close associate of Tudor’s and has been seen entering and leaving his house. Dumitru is also Sorin Velcu’s brother.
At the beginning of February, their cousin, Antonio-Marian Dumitru, and another gang member had been detained in Barbados, just days before Maria was stopped at Cancún’s airport.
Antonio-Marian and his associate were caught skimming ATMs in Barbados. A magistrate fined them 20,000 Barbados dollars and ordered them deported. The Barbadian lawyers hired to represent Antonio-Marian received money from Craiova via Western Union in several installments sent by different people, including from his mother.
In July last year, the two men were on the wanted list of the Royal Barbados Police Force, according to the news website Loop Barbados.
By conducting much of their business in cash, the gang made it difficult for investigators to follow the money trail. However, there are records of a few large transfers through banks.
In 2016, Rebeca Tudor received 109,755 euros in two installments from her husband, who at the time was running his operation in Mexico. The same year and the next, she received another 299,419 euros, this time from Adrian Enachescu, The Shark’s stepbrother and a shareholder in Top Life Servicios, the company the gang set up to install rigged ATMs in Mexico.
Then in January 2019, Rebeca wired $127,000 to Enachescu in Mexico. This time, the transfer triggered an alarm. A bank employee called her the next day. She explained that it was the repayment of a loan
In fact, the bank had picked up on how the gang launders money through real estate loans.
Rebeca received money from the gang via bank transfers and in cash, then loaned it to a company she set up in 2016, Seven Residence SRL. Seven Residence would use the money to construct apartments. Rebeca would then sell the apartments through her company and send money back to the gang, completing a full money laundering cycle.
For example, on the same day in January 2019 that she wired the funds to Enachescu, Rebeca had sold an apartment in Craiova for around 92,000 euros through Seven Residence.
The buyer of the apartment paid an advance of about 30,000 euros into the account of Seven Residence. On the same day, the company wired around 48,000 euros to Rebeca’s personal account, which was marked as loan repayment. She added to her account 51,000 euros through a deposit of cash that prosecutors say was handed to her by the Velcu family, including the $20,000 dug out of their backyard.
Then she bundled all this money and sent it to Mexico.
Along with the apartment building, Seven Residence put up an office tower in Balta Craiovitei, a marshy area on the outskirts of Craiova that the city had decided to develop.
“Let’s convert Balta Craiovitei from the land of frogs and snakes into a fairyland for children,” said Lia Olguta Vasilescu, the former mayor of Craiova, in an advertisement for her 2012 electoral campaign.
Two years later, when she was mayor, Vasilescu signed a building permit for the plot of land purchased by Rebeca and an associate. Florian Tudor is listed as co-owner, according to a purchase contract.
Vasilescu told OCCRP she knew neither of the Tudors. “I don’t know either the lady or the gentleman,” she said. “A mayor signs 600 documents a day. … I did not used to interact with those who requested construction permits.”
Prior to the Seven Residence project, Rebeca used money sent from Mexico to build one of three houses on the outskirts of Craiova. One of those houses was sold in July 2017 to a member of Tudor’s gang, Alin Gabriel Stroe, who paid over 120,000 euros.
In addition to Romania, The Shark also funneled money into real estate in the United States and Brazil. But the main investments were in the Mayan Riviera region of Mexico’s Quintana Roo State.
Tudor’s crew purchased a house and an adjacent plot of land in June 2015 through their real estate company Inmobiliaria Investcun, which Enachescu had incorporated in Mexico about three weeks earlier. They paid $214,000 for the one-story building in Cancún, which previously housed the Quintana Roo Institute of Real Estate Heritage.
By late 2017, the Riviera Maya gang had transformed the ex-government building into an imposing behemoth with a gym and an elevator that serviced a rooftop pool. This was the epicenter of The Shark’s operations, though he said it was his family home after police raided it on May 11, 2019.
Neighbors told OCCRP they had been intimidated by armed men coming and going from the now-sprawling complex, which towers over other houses. The neighborhood welcomed the police raids, said one neighbor.
“Everyone on the block was happy,” said the neighbor on condition of anonymity.
But residents were disappointed as The Shark and his gang were soon back to their headquarters and business as usual. Police have so far not divulged the reason for the search or what Tudor and his associates are being investigated for.
“[Security forces] saw that they couldn’t do anything to them,” said the neighbor.
Inmobiliaria Investcun bought another property in 2017, a two-story duplex on the street behind Tudor’s house for over $111,000.
Through Inmobiliaria Investcun, The Shark also owns one luxury condominium and four other properties in Cancún, with a combined value of around $2.2 million, according to records obtained from the city council through freedom of information requests. They are all in Puerto Cancún, a formerly mangrove-covered section of coast that now features a new 20-floor, fin-shaped building called Shark Tower.
The March 2019 arrest of Tudor and his friend, Cosmin Adrian Nicolae, shed light on another real estate venture in the Mayan Riviera. They were stopped at a police checkpoint while driving south of Cancún towards Puerto Morelos, a fishing village turned tourist destination. Officers found an illegal 9mm pistol and ammunition, along with more than $25,000 cash in pesos and dollars, according to the Quintana Roo Attorney General’s Office.
The cash, according to Romanian police, was intended to pay workers constructing a residential complex on a 1,400-hectare parcel of land near Puerto Morelos.
Property records show that Tudor also owns a $1.37-million condo in Sunny Isles Beach, a luxurious Miami neighborhood. He and Juceline Belmonte do Amaral, whom he refers to as his wife, purchased that property in January 2016. They bought an adjacent dock in July that year for $94,500.
The couple never lived in that condo and have had it on and off the market since November 2017. In January 2020, they set up a Florida company called Jucilene Amaral & Florian Tudor LLC, which they then used to take out a $400,000 mortgage on the property.
Tudor’s relationship with Belmonte do Amaral appears to coincide with real estate investments in her native country, Brazil, and activities in the region around her hometown of Foz do Iguaçu. The city sits next to the world-renowned Iguaçu waterfall, on the border junction with Paraguay and Argentina, an area notorious as a hub for smuggling drugs, contraband, and people.
In 2016, Paraguayan police in Ciudad del Este, directly across the river from Foz do Iguaçu, arrested two Romanians driving a vehicle registered to Julio Cesar, a brother of Belmonte do Amaral. They were carrying credit and debit cards presumed to be cloned, along with a magnetic strip reader. One of the men, Marian Zarcu, worked for Tudor coordinating the teams that withdrew cash from victims’ accounts, according to Romanian investigators.
Two years earlier, Tudor had bought a Mexican firm from another brother of Jucilene, Juliano Belmonte do Amaral. It is a currency exchange store that today operates a chain throughout the Mayan Riviera and other tourist destinations in Mexico.
The Romanian, U.S., and Mexican properties identified by OCCRP only offer a partial picture of the Riviera Maya Gang’s real estate portfolio. Romanian authorities say Tudor also owns plots of land in Brazil.
“The money obtained from illegal activities was and is invested in real estate that is sold or rented,” said the prosecutors, adding that gang members often stash the illicit cash in unorthodox spots until it can be laundered.
“Part of the money is hidden, buried in backyards of the houses of the members of the group.”
