CINCINNATI (Enquirer) - A man with apparent ties to Bulgaria faces up to 40 years in prison for his alleged role in installing devices on local bank ATMs that compromised at least 776 card numbers, according to court documents obtained by FOX19 NOW’s media partners at the Cincinnati Enquirer.
The scheme involved using ATM skimmers to get data from debit cards, then using re-encoded cards to withdraw cash after entering personal identification numbers that had been stolen using video cameras, court documents said.
Yordan Kovachev, who is not a U.S. citizen, is being held without bond at the Butler County Jail. Federal Magistrate Judge Karen Litkovitz said in court documents that Kovachev, who is 35, "has substantial contacts with a foreign country and could flee the United States before trial."
That country is not named in court documents, but a Bulgarian interpreter was present at a Feb. 27 detention hearing in federal court in Cincinnati.
Kovachev has no job, court documents say. He was arrested driving a 2015 Mercedes-Benz sedan.
His attorney, John O'Shea, did not respond to requests for comment late Wednesday.
The ATMs were in Colerain Township, Norwood and Walton, Kentucky.
The investigation began after an unnamed local bank reported to law enforcement that skimmers had been found on two of the bank’s ATMs, in Colerain Township and Norwood. Several customers had disputed cash withdrawals from the machines.
Withing two days in early September 2019, the skimmer at the Colerain Township ATM compromised 391 credit or debit card numbers, court documents say. The skimmer in Norwood compromised another 218.
Video from the Norwood ATM showed a man believed to be Kovachev – wearing a dark hat and grey long-sleeve DKNY T-shirt – walk up to the ATM at about 12:50 p.m. on Sept. 7.
Kovachev appeared to install a skimmer into the card reader, court documents say. He then inserted multiple cards into the ATM card reader without appearing to receive any cash, the documents say.
Minutes later, a second, unidentified person – wearing a black hat and white, long-sleeve T-shirt – walked up to the ATM and installed a camera to capture customer PIN information, the documents say. That person then left.
The next day, on Sept. 8, a vehicle that appeared to be a silver Mercedes-Benz drove through an empty parking lot in front of the Norwood ATM. An unknown person appeared to remove the camera installed to capture the PINs, the documents say.
Minutes later, Kovachev and the second unknown person separately approached the ATM and inserted multiple cards without receiving any cash, the documents say.
Two weeks later, on Sept. 21, the documents say Kovachev withdrew $100 from one of the same bank’s ATMs in Deer Park. He used a debit card number that had been compromised at the Colerain Township ATM, according to the documents.
On Sept. 22, an unknown person drove up in a silver Mercedes-Benz with Kovachev in the passenger seat. That unknown person withdrew $100 using a card that had been compromised at the Colerain Township ATM, court documents say.
In October, court documents say the bank recovered a blank white card "with no embossing” from the ATM. The card had a chip on the front. On the back was a magnetic strip and a sticker with a hand-written four-digit number.
Using the account number that was encoded on the card, the bank determined that a skimmer had been installed at its ATM in Walton, Kentucky from Sept. 20 to Sept. 21, 2019. That skimmer compromised 167 card numbers.
Photographs of transactions from that ATM appeared to show Kovachev drive up in a silver, 2015 Mercedes-Benz sedan, with Illinois license place, court documents say.
When he was arrested Jan. 21 in Pennsylvania, he was driving a silver, 2015 Mercedes-Benz sedan.