More than 50 defendants have been charged in a years-long crackdown on organized theft rings – many with ties to Romania – that steal millions of dollars in public assistance benefits from low-income families who depend on those funds for food, housing, and other necessities.
The cases are part of an ongoing enforcement effort in the Southern District of California targeting crews that allegedly exploit the government’s Electronic Benefit Transfer system.
The defendants sentenced so far in this crackdown are collectively responsible for stealing at least $4 million from the EBT accounts of hundreds of California victims, including many San Diego County residents.
The four defendants are Razvan Balu, Juan Trandafir, Hassib Baraekzay, and Veronica Ochoa. Balu and Trandafir, both Romanian, are respectively accused of stealing $160,000 and $145,250 from victims’ CalWORKS benefit accounts. CalWORKS administers grants from the U.S. Department of Health and Human Services to help families remain housed.
Investigators say members of these rings often descend on ATMs, often in the pre-dawn hours, almost immediately after the funds are dispersed by the state, rapidly draining funds from compromised accounts and leaving vulnerable victims without the benefits they rely on to survive.
“These criminals target people living one paycheck away from crisis,” said U.S. Attorney Adam Gordon. “Exploiting that vulnerability is as cruel as it is criminal.”
Four of the most recent defendants appeared in federal court last week to face charges that they each stole public assistance benefits from low-income families that need the funds to pay for food, housing, and other necessities.
Baraekzay and Ochoa, who are U.S. citizens, are each charged with stealing more than $20,000 of CalWORKS benefits.
“These charges underscore the serious consequences faced by individuals who exploit federal programs for personal gain,” said Special Agent in Charge Robb R. Breeden of the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG). “This scheme diverted valuable taxpayer funds from programs designed to support people most in need. Working closely with our law enforcement partners, HHS‑OIG will continue to pursue those who target the vulnerable and compromise public trust in government assistance programs.”
Last week’s arrests bring the total number of people charged with stealing CalWORKS benefits by the U.S. Attorney’s Office in San Diego to 52 since 2023. These federal arrests are the work of the U.S. Secret Service’s Southern California Cyber Fraud Task Force (SoCal CFTF).
“The U.S. Secret Service and our partners on the Southern California Cyber Fraud Task Force are committed to combatting EBT fraud and credit card skimming,” said Andre Remy, the Special Agent in Charge of the U.S. Secret Service’s San Diego Field Office. “This years-long investigation is a testament to the hard work and tireless dedication of law enforcement to actively investigate and arrest criminals that target our most vulnerable community members.”
EBT theft has significantly impacted California, with substantial losses reported in recent years. Between June 2022 and January 2026, more than $310 million was stolen from EBT beneficiaries in California, primarily through unauthorized ATM withdrawals.
Balu was arrested on March 1 in Los Angeles County for Conspiracy to Commit Access Device Fraud during a SoCal CFTF operation targeting EBT card skimming fraud at ATMs, while Baraekzay and Ochoa were arrested in San Diego County on March 2 and 3.
According to the complaint charging Balu, between January 1, 2026, and March 1, 2026, Balu used the public assistance account information of approximately 210 victims who live in San Diego, Fresno, Los Angeles, Kern, Kings, and Tulare counties. He allegedly used this account information to make unauthorized withdrawals at Los Angeles County ATMs, accessing and attempting to steal funds from the victims’ public assistance benefit accounts.
During this period, Balu attempted to withdraw $196,650 and successfully withdrew $159,990 from the victims’ accounts.
EBT is a card-based system used to distribute government benefits, including CalFresh (food assistance) and CalWORKs (cash aid). It works like a debit card, allowing recipients to purchase food and withdraw cash at participating retailers and ATMs.
According to charging documents, the U.S. Secret Service has gathered evidence indicating members of what appear to be one or more criminal enterprises are stealing California EBT account information by installing skimmers on point-of-sale terminals and inside ATMs, often in communities with higher concentrations of public benefit recipients. The skimmed data is then often re-encoded onto the magnetic strips of cards that members of the conspiracy use to make unauthorized withdrawals and purchases.
These re-encoded cards are sometimes referred to as “cloned” cards. Cloned cards can be a blank white plastic card or another debit, credit, or gift card. Cloned cards may have names or numbers embossed on the physical card. A common feature of cloned cards is that the account number encoded on the card’s magnetic strip will not match the number embossed on the card’s face. To facilitate the use of stolen EBT benefits, scheme members commonly place stickers bearing the account’s PIN on physical cards or access devices swiped at a point-of-sale terminal, along with the account balance.
Once in possession of the cloned cards, account PIN, and anticipated balance, the thieves will go to ATMs, often in the pre-dawn hours, to drain those benefits before the rightful recipients can access them.
Assistant U.S. Attorney Sabrina Fève is prosecuting this case. Nearly a dozen agencies worked together to bust this alleged fraud.
Balu, 35, faces charges of conspiracy to commit access device fraud. Balu faces a maximum penalty of five years in prison and a $250,000 fine, or twice the pecuniary gain or loss