Two Florida men are jailed and accused of draining $14,400 from a Lakeville bank through an ATM hacking scheme known as “jackpotting,” a sophisticated crime in which crooks gain access into cash machines and install malware that makes them spit out wads of bills on demand.

Robert R. Rosales Rivero, 43, and Geniver Antonio Pinuela Testa, 23, both Venezuelan nationals living in Miami, were charged Monday in Dakota County District Court with felony theft for the Oct. 6 thievery at Lakeview Bank, located along 163rd Street east of Interstate 35.

Robert R. Rosales Rivero, 43, and Geniver Antonio Pinuela Testa, 23, both of Miami. (Courtesy of the Dakota County sheriff’s office)

Law enforcement and banking security officials say jackpotting is the latest tactic for stealing from ATMs, and it first reached Minnesota within the past year.

Rosales Rivero and Pinuela Testa were arrested five days after the Lakeville theft during a traffic stop in Shakopee. They made first court appearances Monday, and remained at Dakota County Jail on Thursday in lieu of $75,000 bail.

The Dakota County Attorney’s Office requested the bail amount “based on reappearance concerns” and because the two men are suspected of similar crimes in Michigan and other states, according to a court filing. They also “have ties” to another country, the filing said.

ATM jackpotting first popped up in Europe and Asia around 2016, according to media reports. It hit the United States two years later, prompting the U.S. Secret Service to sound the alarm to financial institutions and law enforcement agencies.

“To execute a jackpotting attack, perpetrators must gain physical access to the cash machine and install malware, or specialized electronics, or a combination of both to control the operations of the ATM,” the alert said.

The criminals range from individual suspects to large organized groups, from local crooks to international organized crime syndicates, the Secret Service said.

This June, the Secret Service issued another alert to banks and law enforcement, warning of an increase in successful and unsuccessful jackpotting incidents in 15 states, including Minnesota, over the past six months.

“Subjects were observed opening and accessing the ATMs using magnets and generic keys designed to unlock an ATM’s exterior,” the alert said. “The subjects are believed to still be in the U.S. and are expected to continue to carry out additional ATM attacks.”

‘Small handheld device’

According to the Dakota County criminal complaint, a Lakeview Bank employee reported the theft the next day, telling an officer that  an automated email advised the ATM was low on cash. An officer discovered the switch that controls the opening and closing of an ATM vault door was broken.

Police were given bank surveillance video, which showed the suspects near the bank around 2 p.m. Oct. 6. An hour later, a man approached the ATM. He had an earpiece in his right ear. He left on an electric scooter.

The video then showed three suspects — all men — riding up to the ATM on electric scooters at different times. They had on either medical masks or sweatshirts with the hoods up. One suspect “manipulated a small handheld device with pushbuttons and a small screen,” the complaint said.

Michigan State Police contacted the Minnesota State Patrol on Oct. 11 about an investigation of suspects jackpotting ATMs in Michigan.

The same day, Minnesota state troopers located the suspects’ vehicle at a Super 8 hotel in Shakopee. When two men left the hotel, law enforcement pulled over the vehicle and identified them as Rosales Rivero and Pinuela Testa. A search of Pinuela Testa turned up $440 cash in $20 denominations, the complaint said.

Officers also found in the vehicle a laptop and the handheld device seen on the bank’s surveillance. Clothing that matched what the suspects had worn were also found.

Related Articles

Mankato trial begins in 2023 slaying of Madeline Kingsbury

Man rescued from St. Paul housefire after firefighters were told home was clear

Hennepin County Sheriff’s Office suspends DNA testing after issue at crime lab

‘This crowd was amazing’: Trio plays classical concert for appreciative Stillwater Prison inmates

Man fatally shot in St. Paul’s North End identified as 42-year-old from Little Canada

Officers saw electric scooters in the vehicle that also matched those the suspects used to approach ATMs in the Lakeville and Michigan cases, according to a search warrant affidavit written by a Shakopee police investigator.

Police executed a search warrant at the suspects’ first-floor hotel room and located $7,900 in cash, passport papers, two laptop computers, a flash drive, cellphone, backpack with electronic components, key for a Hyosung ATM and a white powdery substance suspected to be cocaine, according to an inventory report.

In Michigan, Rosales Rivero and Pinuela Testa are suspects in jackpotting cases that totaled more than $130,000, Lakeville police Lt. Jason Jensen said Thursday. He said they are Venezuelan nationals, and that one of them is in the U.S. on a work visa.

Law enforcement has yet to identify the third Lakeville suspect, Jensen said.

ATM theft trends

It’s no surprise ATMs have been a target for thieves for as long as they’ve been around dispensing cash.

“Wherever there’s money, bad guys are going to try to figure out how to get it,” said Troy Case, owner and CEO of Case Financial, an Anoka-based company that specializes in ATM security and selling the machines to banks and credit unions. “You’ve got a nice box of cash sitting out there on an island.”

ATM “skimming” goes back at least two decades. In that scheme, crooks put a small device inside or outside the ATM to record customers’ credit card information. “Skimming is still going on,” Case said. “I had an attempted skim on a client two weekends ago on three of their machines.”

In recent years, crooks have turned to a more crude tactic: hooking up a heavy chain to an ATMs shutter, where the cash comes out, and then hitting the gas pedal in an attempt to yank open the safe door.

A group of men from Texas tried just that in a stolen pickup truck at Great Southern Bank in Roseville in December, according to criminal charges. One suspect was captured after he sped away and crashed. Four others were tracked back to a nearby hotel and arrested after a standoff with a SWAT team.

Court records show a case against one of the men has been dismissed, and that warrants have been filed against the others for failing to show up to court hearings after bonding out of jail.

Workers replace an ATM at Great Southern Bank in Roseville on Thursday Dec. 14, 2023. The previous ATM was damaged Tuesday after authorities said five men used a stolen pickup and chain in an attempt to remove it. (John Autey / Pioneer Press)

Case said his company, which primarily does business in the Upper Midwest, started hearing about jackpotting in Minnesota this year. He knows of ATMs being hit in St. Cloud, Rochester, Big Lake and Duluth. “That’s just the ones that I happened to hear of,” he said. “I’m sure there’s been more.”

He said the scheme starts when the thieves procure a key — usually online — to open the top of an ATM.

“They’re getting access to that top hat, going in and pulling out the hard drive and injecting it with their own malware. And now they have control of the machine,” he said. “I don’t know how they’re dispensing cash. I don’t know if they’re changing the denomination values, or if they’ve got some code that just tells the machine to dispense a bunch of notes.”

Law enforcement has caught up with some of the alleged thieves in recent months.

Related Articles

Mankato trial begins in 2023 slaying of Madeline Kingsbury

Hennepin County Sheriff’s Office suspends DNA testing after issue at crime lab

Man fatally shot in St. Paul’s North End identified as 42-year-old from Little Canada

Prosecutors: With self-defense at issue, man won’t be charged in deadly stabbing in St. Paul

First Feeding Our Future defendant sentenced gets 12 years

In May, a Miami man was indicted in California federal court in a jackpotting scheme that stole more than $2.6 million from credit unions and banks across multiple states.

This month, six men, all citizens of Venezuela, were indicted in New York federal court for their alleged involvement in what prosecutors called a nationwide ATM jackpotting scheme that netted more than $400,000 in several upstate counties.

Case said his company urges clients to take three main security measures to try and stop jackpotting: installing an alarm on the ATM’s top cover, and making sure the hard drive is encrypted and up to date with anti-malware software.

“It’s a little scary if you’re not alarmed and don’t have those mitigations, because these jackpotters kind of got a free ticket to money,” he said.