More than 50 Charged in Thefts of Millions of Dollars in California Benefits for Low-Income Families

SAN DIEGO – More than 50 defendants have been charged in a yearslong crackdown on organized theft rings – many with ties to Romania – that steal millions of dollars in public assistance benefits from low-income families who depend on those funds for food, housing, and other necessities.

The cases are part of an ongoing enforcement effort in the Southern District of California targeting crews that allegedly exploit the government’s Electronic Benefit Transfer (EBT) system. Investigators say members of these rings often descend on ATMs, often in the pre-dawn hours almost immediately after the funds are dispersed by the state, rapidly draining funds from compromised accounts and leaving vulnerable victims without the benefits they rely on to survive.

“These criminals target people living one paycheck away from crisis,” said U.S. Attorney Adam Gordon. “Exploiting that vulnerability is as cruel as it is criminal.”

“These charges underscore the serious consequences faced by individuals who exploit federal programs for personal gain,” said Special Agent in Charge Robb R. Breeden of the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG). “This scheme diverted valuable taxpayer funds from programs designed to support people most in need. Working closely with our law enforcement partners, HHS‑OIG will continue to pursue those who target the vulnerable and compromise public trust in government assistance programs.”

“The U.S. Secret Service and our partners on the Southern California Cyber Fraud Task Force are committed to combatting EBT fraud and credit card skimming,” said Andre Remy, the Special Agent in Charge of the U.S. Secret Service’s San Diego Field Office. “This years-long investigation is a testament to the hard work and tireless dedication of law enforcement to actively investigate and arrest criminals that target our most vulnerable community members.”

Four of the most recent defendants appeared in federal court last week to face charges that they each stole public assistance benefits from low-income families that need the funds to pay for food, housing, and other necessities.

The four defendants are Razvan Balu, Juan Trandafir, Hassib Baraekzay, and Veronica Ochoa.  Balu and Trandafir, both Romanian, are respectively accused of stealing $160,000 and $145,250 from victims’ CalWORKS benefit accounts.  CalWORKS administers grants from the U.S. Department of Health and Human Services that are designed to help families remain housed. Baraekzay and Ochoa, who are U.S. citizens, are each charged with stealing more than $20,000 of CalWORKS benefits.

Last week’s arrests bring the total number of people charged with stealing CalWORKS benefits by the U.S. Attorney’s Office in San Diego to 52 since 2023. These federal arrests are the work of the U.S. Secret Service’s Southern California Cyber Fraud Task Force (SoCal CFTF).

The defendants sentenced so far in this crackdown are collectively responsible for stealing at least $4 million from the EBT accounts of hundreds of California victims, including scores of San Diego County residents. Please see chart below for status of all cases charged.

EBT theft has significantly impacted California, with substantial losses reported in recent years. Between June 2022 and January 2026, more than $310 million was stolen from EBT beneficiaries in California, primarily through unauthorized ATM withdrawals.

Balu was arrested March 1 in Los Angeles County for Conspiracy to Commit Access Device Fraud during a SoCal CFTF operation targeting EBT card skimming fraud at ATMs, while Baraekzay and Ochoa were arrested in San Diego County on March 2 and 3.

According to the complaint charging Balu, between January 1, 2026, and March 1, 2026, Balu used the public assistance account information of approximately 210 victims who live in San Diego, Fresno, Los Angeles, Kern, Kings, and Tulare counties. He used this account information to make unauthorized withdrawals at Los Angeles County ATMs in which he accessed, attempted to steal, and stole from the victims’ public assistance benefit accounts.

During this period, Balu attempted to withdraw $196,650 and successfully withdrew $159,990 from the victims’ accounts.

EBT is a card-based system used to distribute government assistance benefits like CalFresh (food assistance) and CalWORKs (cash aid). It works like a debit card, allowing recipients to purchase food and withdraw cash at participating retailers and ATMs.

According to charging documents, the U.S. Secret Service has gathered evidence indicating members of what appear to be one or more criminal enterprises are stealing California EBT account information by installing skimmers on point-of-sale terminals and inside ATMs, often in communities with higher concentrations of public benefit recipients. The skimmed data is then often re-encoded onto the magnetic strips of cards that members of the conspiracy use to make unauthorized withdrawals and purchases.

These re-encoded cards are sometimes referred to as “cloned” cards. Cloned cards can be a blank white plastic card, or another debit, credit, or gift card. Cloned cards may have names or numbers embossed on the physical face of the card. A common feature of cloned cards is that the account number encoded on the card’s magnetic strip will not match the number embossed on the card’s face. To facilitate the use of the stolen EBT benefits, members of the scheme will commonly put stickers bearing the account’s PIN on the physical cards, or access devices, that are swiped at a point-of-sale terminal, along with the account balance.

Once in possession of the cloned cards, account PIN, and anticipated balance, the thieves will go to ATMs, often in the pre-dawn hours, to drain those benefits before the rightful recipients can access them.

This case is being prosecuted by Assistant U.S. Attorney Sabrina Fève.

If you or someone you know has had EBT benefits stolen, San Diego County’s Department of Health & Human Services Agency requires that the theft be reported within 10 days.  More information for San Diego County victims is available at:

https://www.sandiegocounty.gov/content/sdc/hhsa/programs/ssp/ebt_fraud.html.  

DEFENDANT                                  Case Number 24MJ1234                                              

Razvan Balu                                       35             Drobeta Turnu Severin City, Romania

SUMMARY OF CHARGES

Conspiracy to Commit Access Device Fraud – Title 18, 18 U.S.C. §§ 1029(b)(2), 1029(a)(2), 1029(a)(4), and (c)(1)(A)

Maximum penalty: Five years in prison and $250,000 fine, or twice the pecuniary gain or loss

INVESTIGATING AGENCIES

U.S. Secret Service’s Southern California Cyber Fraud Task Force

San Diego District Attorney’s Office

U.S. Department of Health and Human Services’ Office of Inspector General

California Department of Social Services

San Diego Police Department

San Diego Sheriff’s Department

U.S. Department of Agriculture’s Office of Inspector General

Homeland Security Investigations

Los Angeles District Attorney’s Office

United States Attorney’s Office for the Central District of California

*The charges and allegations contained in an indictment or complaint are merely accusations, and the defendants are considered innocent unless and until proven guilty.