Eric Vitale, fraud investigation specialist with the San Luis Obispo Police Department, demonstrates how to spot a card skimmer on an ATM, gas pump or other card reader. He also offers advice for keeping your PIN and card information safe. David Middlecamp The Tribune
Eric Vitale, fraud investigation specialist with the San Luis Obispo Police Department, demonstrates how to spot a card skimmer on an ATM, gas pump or other card reader. He also offers advice for keeping your PIN and card information safe. David Middlecamp The Tribune

Local

Hundreds of Golden 1 accounts hacked by skimming devices

By Sam Stanton

sstanton@sacbee.com

December 01, 2017 03:58 PM

UPDATED December 02, 2017 11:45 AM

Hundreds of Sacramento-area bank accounts were compromised between April and August by electronic skimming devices planted inside Golden 1 Credit Union ATMs, federal officials say.

Two men have been arrested and face federal conspiracy charges in a case involving at least three ATMs in Sacramento, Citrus Heights and El Dorado Hills, according to a criminal complaint filed Friday in U.S. District Court in Sacramento.

Authorities have arrested Luis Jose Ruiz Gaina, 44, and Ricardo Gabriele-Plage, 37, who both carried Venezuelan passports.

“Through this investigation, law enforcement has learned that a group of individuals have used a device known as a deep insertion skimmer to steal the debit and credit card numbers of bank and credit union customers who used the targeted ATMs,” according to a Department of Homeland Security affidavit filed in court. “Once the members of this group obtained the card numbers, they used the numbers to withdraw money from the victims’ accounts.”

Never miss a local story.

Sign up today for a free 30 day free trial of unlimited digital access.

According to the affidavit, the skimmers were inserted inside the ATMs to record card numbers and account information, and were accompanied by hidden cameras to capture each customer’s personal identification number, or PIN.

“Golden 1 Credit Union places the highest priority on member security and trust. Upon identifying these incidents, we immediately notified affected members and replaced their cards,” said Tom Genessy, Golden 1 executive vice president for service operations, security, and technology, in a statement. “We also notified all other financial institutions whose cardholders conducted a transaction at one of the affected ATMs during the window of compromise.”

The case apparently began on April 6 at the Golden 1 ATM at 5040 Auburn Blvd., court documents say, where video surveillance cameras recorded a skimming device being inserted into the ATM just after midnight.

Court documents say Gainza placed the device on the ATM, then returned at 1:40 a.m. to check the device and adjust the camera. At 8 p.m., three unidentified men removed the device and camera, and authorities later determined that 109 bank and credit union accounts had been compromised.

Golden 1 later received fraud claims from 37 customers reporting unauthorized transactions totaling nearly $21,000, court documents say.

The next intrusion came on Aug. 2 at the Golden 1 ATM at 4311 Town Center Blvd. in El Dorado Hills, court documents say.

There, video surveillance captured images of Gainza installing a skimming device at about 6 a.m. and testing it. The device stayed in place until 6 p.m., when an unidentified man removed it, court documents say, followed by Plage, who removed the camera.

Court documents say 178 accounts at that location were compromised, but they do not indicate how much money may have been lost.

The group returned to the same machine the next day, with Gainza installing a skimmer at 12:40 a.m., court documents say. The skimmer and camera were removed by 7 a.m., and 11 accounts were compromised, the affidavit says.

The ATM was hit for a third consecutive day on Aug. 4, when cameras caught Gainza installing a skimming device at about 12:20 a.m. and an unidentified man installing a PIN pad camera at about 5:30 a.m., court document say.

“When the Aug. 4 incident occurred, we checked our entire ATM network, identified a second affected ATM, and immediately decommissioned them until the integrity of the machines was restored,” Genessy said. “We then partnered with local law enforcement, which led to the arrest. Because we reimbursed each of them, no Golden 1 member who was affected by this incident incurred a financial loss. We routinely inspect our ATMs and monitor for any suspicious activity.”

An ATM technician visiting the machine at 5:30 p.m. discovered the device, and authorities say 228 accounts were compromised that day.

Authorities say Plage was caught on camera that same night at 9:40 at the Auburn Boulevard ATM, and that Gainza showed up just before midnight and installed a skimmer there. The skimmer and camera were removed just before 2 p.m., court documents say, and 71 accounts were compromised.

Gainza installed another skimmer inside a Golden 1 drive-up ATM at 5901 Sunrise Blvd. in Citrus Heights on Aug. 5 just after midnight, officials say. An ATM technician found it just before 5 p.m., and authorities later determined 266 accounts had been compromised, court documents say.

Authorities from the Sheriff’s Department and the Sacramento Valley Hi-Tech Crimes Task Force later used ATM suveillance video to identify the suspects and rental cars they were driving, documents say. Gainza and Plage were pulled over and arrested on Aug. 5 in a Sunrise Boulevard parking lot.

Both men were charged in Sacramento Superior Court with 35 counts of identity theft and are being held at the Rio Cosumnes Correctional Center.

The subsequent federal criminal complaint filed Friday charges both men with conspiracy to possess counterfeit devices, which could net them up to five years in prison. Gainza also faces up to 15 years for a charge of possessing device-making equipment.

Sam Stanton: 916-321-1091, @StantonSam