Yaisder Herrera Gargallo and Meylisi Rueda seemed like a normal couple, enjoying a vacation and spending lots of money on small luxuries in Portland, Me., more than 1,300 miles from their Miami home. But the credit cards they and others in their visiting group were using to live the good life did not belong to them.
Police say the couple used credit and debit cards cloned in June of 2016 for purchases at stores around the city, including Best Buy, Sears and Walgreens. A search of their rented Jeep Patriot turned up 47 cards, two card skimmers and a laptop with the personal information from several people collected starting in November of 2015.
The group’s modus operandi is common for criminals who clone debit and credit cards by installing skimmers at places like gasoline stations and ATMs.
Court records and police officials indicate that South Florida criminals are increasingly venturing out to other states, alone or in groups, to work their scams.
South Florida residents are more cautious and alert to these types of scams than people in other parts of the country, said Detective Marcos Rodriguez, with the economic crimes bureau of the Miami-Dade Police Department.
“There was a wave of thefts of credit cards in Miami and Broward, so people are more aware of the (fraudulent) cards. You go to another state and they are more relaxed,” Rodriguez said.
Florida regularly reports one of the highest numbers of identity thefts, which include cloning credit cards. U.S. Federal Trade Commission statistics show it ranked second in 2017, with 31,167 cases reported.
In contrast, most of the cities targeted by the South Florida scammers tend to be in states with low numbers of identity thefts, such as Maine, West Virginia, Mississippi and Wisconsin.
Over the last two years, nearly 40 Florida residents have been arrested and put on trial in Georgia, North Carolina, Virginia, West Virginia, Alabama, Tennessee, Colorado, Maryland, Utah, Maine, Mississippi, Washington and specially Ohio and Wisconsin, according to prosecutors in those states.
José Castillo Febles, 31, a member of Herrera Gargallo’s group in Maine, told authorities that he and his father decided to go to the New England state because they believed that “the farther they were from Miami, the lower the chances of being caught.” They were less than 200 miles from Canada when they were arrested.
Herrera’s group was charged with fraud, conspiring to commit fraud, having more than 15 credit cards and aggravated identity theft. He and father-and-son team José Castillo Febles and Juan Carlos Febles, were sentenced to 32 to 40 months in prison and three years of supervised release. Meylisi Rueda, the only woman in the group, pleaded guilty in November and is awaiting sentencing.
Rodriguez said it’s not unusual for South Florida criminals to go elsewhere to break the law.
“Miami is the gateway of the Americas. All the crimes enter through here and go on to other places. This is where they learn, and it spreads to the entire country later,” he said.
A 20 second business
The business of card scammers starts with small devices known as skimmers that can be built at home with materials bought in any store for less than $150.
The criminals then generally install the devices at gasoline pumps — usually outside the view of security cameras — an operation that Rodriguez said can take all of 20 seconds.
Surveillance videos have captured the criminals deploying the devices in full daylight and right next to unsuspecting customers. Criminals sometimes use vans, and witnesses believe they are maintaining the pumps.
Court documents show that some criminals distract the gas station attendants while others install the devices.
Rodriguez said it’s easy to get inside the gasoline pumps because their locks use universal keys. “There are inspectors, workers from the Agriculture Department and Consumer Services or the private companies that service the pumps. With so many gas stations, you can imagine how many keys they would have to have.”
Once the skimmer is in place, the criminals just wait for the device to capture the information of customers using cards at the pump. Each skimmer can store about 2,000 credit card numbers, said Rodriguez. Ten numbers can be purchased on the dark web for $50.
Although gas stations are the preferred targets for card scammers, the devices can be installed anywhere that accepts credit or debit cards, from ATMs to Redbox stations, movie ticket dispensers and even parking meters, said investigative journalist Brian Krebs, founder of KrebsonSecurity, which focuses of cyber-crimes.
Rodriguez said that a few years ago criminals operated mostly in places like cafeterias and restaurants, where crooked employees could discretely swipe cards on the skimmers. But that fell off significantly with the arrival of cards with security chips.
Most of the scammers who stay in South Florida use the fraudulent cards to buy gasoline and later resell it. Last week, Miami-Dade Police arrested a group of 13 people who stored fraudulently purchased gasoline in large tanks aboard vans and trucks, and sold it later on the black market for half the price.
Criminals who travel to other parts of the United States tend to use the cloned cards to buy merchandise they then bring back to Miami for sale.
That’s what Isbel Falcón and Ernesto Camacho did in June of 2016, when the Miami couple used cloned cards to buy a gold necklace and bracelet valued at $4,318.27 at a Ohio jewelry store, according to court records. The couple also spent $1,045.09 at a Best Buy, $334.91 at a Lowe’s and about $400 at Target.
How can you protect your cards?
Although police and some federal agencies like the Secret Service can investigate and jail card scammers, experts say individuals should also try to protect their cards.
Use cash, said Rodriguez. But if you want to use credit or debit cards to buy gasoline, walk into the station and pay the attendant. “It’s 15 little steps that will save you a problem,” he said.
Some experts caution consumers to look over all the security seals on the pumps to make sure they are intact, but Rodriguez said criminals can take photos of the seals, reproduce them and slap them on the pumps.
When using an ATM, look over the machine carefully for anything suspicious. You can also pull on the card reader, because many of the cloning devices can be pulled off with a good yank.
Krebs told El Nuevo Herald that consumers also should use credit cards instead of debit cards when making digital purchases or at stores. “Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (e.g., bounced checks).” he wrote in an email.
Krebs added that it’s important to closely monitor bank accounts and immediately report any suspicious withdrawals or deposits.
But if you had the bad luck of becoming a victim of this type of crime, experts recommend two steps:
▪ Contact your bank to cancel the card.
▪ Report the incident to the police department where your card was stolen or, if you don’t know, to your home police department. This is very important because it helps investigators obtain more information about criminals and their activities.