Fake cars, real cash: How a multimillion-dollar Romanian scheme imploded in Kentucky
16 Nov 2020

A Romanian fraud enterprise made more than $2.7 million by scamming Americans before a Kentucky money launderer-turned federal informant ruptured the operation from within.

The scheme took advantage of victims who thought they were buying cars online via Amazon, AutoTrader, eBay and the like with official-looking documents to prove it. Instead, customers handed over money for products that didn’t exist.

The organization, which was dubbed by authorities as the “Alexandria Online Auction Fraud Network,” had operated since 2013. In late 2014, the criminal enterprise began employing an anonymous associate in Kentucky who laundered money for the criminals residing 5,000 miles away, investigators say.

Federal investigators confronted the Kentuckian, who wasn’t identified in court records, about illegal activity and converted the associate into a confidential source. Evidence mounted as the confidential informant moved millions of dollars through the commonwealth.

As of Friday, investigators had accounted for $2.7 million, which had been moved through Kentucky by the criminal enterprise, according to Gabrielle Dudgeon, a spokesperson for the Department of Justice. That was likely a “sliver” of the actual amount of money the scammers made, Dudgeon said.

Now 15 Eastern European residents and a few Americans — many of whom successfully posed as employees of the well-known commerce sites — are paying the price for fooling customers with convincing emails and invoices that prolonged the enterprise. The network tried to scam people in several Kentucky cities and elsewhere in the United States.

After four indictments, a wave of extraditions and 15 guilty pleas, the accused criminals are either being sentenced in Lexington federal court or they’re already sitting in prisons all over the United States, according to court records.


The network had a hierarchy. There was a “high-level manager” named Bogdan-Stefan Popescu, who was accused of facilitating the fraud, according to court records.

Popescu owned a car wash called Spalatorie Auto Red Link located in Bucharest, Romania. He pleaded guilty to a federal racketeering conspiracy charge on June 11 of this year and was forced to forfeit money and two homes. He awaits sentencing. His other charges were dropped as part of a plea agreement.

Two of Popescu’s car wash employees — Florin Arvat and Alin-Ionut Dobrica — also worked for Popescu in the fraud network. They were low-level employees.

There was a mid-to-high level manager named Andrei-Catalin Stoica. He owned Design Plast PVC Usi Si Ferestre, a door and window company with an office in Romania, and Design Plast Menuiserie, a carpentry company located in Belgium.

Stoica, like Popescu, pleaded guilty to a federal racketeering conspiracy. His other charges were dropped as part of a plea agreement.

Operating below Stoica and Popescu were at least nine “mid-level” managers: Victor-Aurel Grama, Liviu-Sorin Nedelcu, Ionut Ciobanu, Marius-Dorin Cernat, Alexandru Ion, Stefan-Alexandru Paiusi, Eugen-Alin Badea, Cristisor Olteanu and Adrian Mitan.

Popescu, Stoica, and most of the others were from Alexandria, Romania. Four were from other areas in Romania.

For assistance, the Romanians called on U.S. money launderers: Austin Edward Nedved of Massachusetts; Dimitrious Antoine Brown of Georgia or Florida; Rashawd Lamar Tulloch of Georgia; and Andrew Gilbert Ybarra II of California, according to court records.

Beniam-Filip Ologeanu, another Romanian native, also laundered money for the enterprise, according to court records.


“It was the purpose of the conspiracy to entice victims based in the United States to send money to purchase items on the internet that did not exist,” a criminal indictment read.

The fraud team’s method was to create fake advertisements on websites that operate primarily on consumer-to-consumer transactions.

The advertisements generated interest from potential purchasers. From that point, the associates in the network used phony email accounts, social media accounts, trademarked materials and phone numbers to convince the purchasers they were getting legitimate goods.

The victims’ money was laundered through the United States and back into Europe, where it hit the conspirators’ pockets in the form of Romanian lei, Euros and other government-backed currencies.


The organization’s efforts to appear legitimate were incredibly elaborate, according to voluminous court records.

The criminal associates set up fake accounts or got access to accounts that already existed on the e-commerce sites. Other people’s photos and fake names were used to make sales. Previous victims’ identities were sometimes stolen and used to sell and promote vehicles to customers.

By offering refunds, Stoica would get victims to provide copies of photo IDs or debit and credit card information.

The perpetrators also had success posing as members of the U.S. military.

Ciobanu used a Facebook account intended to look like the profile of an Air Force sergeant named Judith Lane. The account featured a photo of an Air Force member and was used to advertise automobile sales.

Cernat allegedly operated a Facebook account as an Air Force member who was being “sent to Iraq to fight against ISIS.”

Advertisements from legitimate sounding businesses peddling vehicles, including a 1969 Ford Mustang or Honda CRV, went directly to prospective customers.

The criminals set up fake customer service email accounts and sent victims invoices for their fake purchases. The emails and invoices featured trademarked branding from legitimate companies, according to criminal indictments.

For instance, ebay.billing.inc@gmail.com, an email address associated with Popescu, was used to send payment confirmation to a victim. It included a counterfeit trademark for eBay.

Grama was one of the associates who oversaw efforts to make the operation appear believable, according to a criminal indictment. He established teams of individuals responsible for pretending to be customer service representatives, according to the indictment.

“These communications included posing as an employee of an online auction website and reassuring customers that the vehicle would arrive with all necessary documentation to obtain clear title,” one indictment read.

Nedelcu sent some of those convincing emails. One such email was an invoice that appeared to be from eBay Buyer Protection. Nedelcu explained to the victim who received the email why payment in prepaid debit cards was necessary.

Nedelcu “reassured” the victim there was a “payment guarantee policy,” according to a criminal indictment. He also told the victim the order had been verified through eBay’s finance department, provided an eBay customer support line and assured the victim a refund could be requested.

Other similar emails sent by multiple defendants had listed phone numbers for fake support departments like the “Amazon support department,” or they had bank account numbers for illegitimate companies like “Auto Value Remarketing Inc,” according to an indictment.

The Romanians “often” asked the Kentucky money launderer for help making invoices more believable or determining payment types, according to a criminal indictment.

Popescu admitted in a plea deal that he coordinated the fraud. He provided co-conspirators with the language and photographs to be used for advertisements and the language to use when responding to buyer inquiries. He also gave them login information for services that could make their IP addresses anonymous, according to the indictment.


The government’s confidential source was a money launderer who began working for the fraud network in late 2014, according to an indictment. The government approached them in June 2015 and the launderer cooperated.

The confidential source was located somewhere in the jurisdiction of the U.S. attorney for the Eastern District of Kentucky, court records say.

The fraud network’s accepted payment methods were usually Green Dot Moneypaks, Visa One Vanilla prepaid debit cards, PayPal My Cash cards, Amazon gift cards, money orders, cashier’s checks, MoneyGram, Western Union wires, or bank wires and deposits, according to court records.

By Jeremy Chisenhall, Lexington Herald Leader, 13 November 2020

Read more at Lexington Herald Leader

RiskScreen: Eliminating Financial Crime with Smart Technology

Advance your CPD minutes for this content, by signing up and using the CPD Wallet