The skimmer at the checkout, the Red Bull at the register, and the mother who could not buy formula
Maria Roza Tomescu was sentenced this week to 28 months for cloning the EBT cards of food-stamp recipients across five states. The machine she fed turned hunger benefits into bulk baby formula and energy drinks, then into cash.
The card reader at the grocery store does not look any different on the morning the trap is set. That is the point.
A woman in Maryland, working two shifts, paid in part by the federal government for the work of feeding her children, taps her EBT card against a terminal at the front of a store. The light goes green. The receipt prints. She loads the bags into the trunk. She drives home. The card goes back in the wallet. The wallet goes back in the purse. The purse goes on the kitchen counter next to the keys.
Somewhere on that terminal, a thin piece of plastic about the size of a domino has been clicked into place over the real card slot. The plastic has its own reader inside it. It copies the magnetic stripe of every card that passes through. It does not slow the line. It does not throw an error. It does not announce itself.
It is a skimmer. That is the entire machine in this story. Everything else is just what people did with what the skimmer collected.
I.
On April 29, 2026, in a federal courtroom in Baltimore, U.S. District Judge Julie R. Rubin sentenced Maria Roza Tomescu, 22, a Romanian citizen, to 28 months in prison. Her co-defendant, Fabritio Sardaru, also 22, a citizen of Romania and Ireland, had been sentenced earlier, on March 9, 2026, to two years. The U.S. Attorney for the District of Maryland, Kelly O. Hayes, announced both sentences.
The charge was conspiracy to commit access device fraud. The plain English is simpler. They cloned poor people's food-stamp cards.
The Supplemental Nutrition Assistance Program, called SNAP, is the federal benefit most people still call food stamps. The benefits arrive on a card that looks like a debit card and runs on a magnetic stripe. That stripe is the same technology a 1985 hotel key used. It is the easiest stripe in modern American commerce to copy. The card is called an Electronic Benefit Transfer card, or EBT. The stripe is what the skimmer takes.
According to the Department of Justice release, the conspiracy reached into Maryland, California, Kentucky, Tennessee, and New York. The Maryland portion alone produced losses of about $343,756. At least fifteen Maryland victims, the prosecutors said in court, could not buy food because of what came off those cards.
II.
Read that slowly.
Fifteen people, at minimum, walked into a store, swiped a card, and watched the screen tell them there was no money where there had been money the day before. Not a margin call. Not a bad investment. Groceries.
A mother on the first of the month checks the balance and the balance is zero. Her rent is paid. Her electric is paid. The thing that was supposed to be untouchable, the thing the federal government delivers because the labor market did not deliver enough, is gone.
There is no broker to call. There is no arbitration clause. There is a phone tree at the state human services office and a wait time measured in hours. While she waits, the children eat what is in the cabinet.
That part may be the saddest part. The fraud Tomescu pleaded to was not a fraud against a bank or a brokerage. The bank gets made whole. The brokerage gets made whole. The mother gets a replacement card and a paperwork process and a month she cannot get back.
III.
Here is what the skimmer collects, and here is what the operator does with it.
The skimmer captures the magnetic stripe data. A separate small camera, or sometimes a fake keypad layered over the real one, captures the four-digit PIN. Together that is everything the system needs to think the next swipe is the cardholder.
The operator takes the stripe data and burns it onto a blank card. Blank cards with magnetic stripes cost about a dollar online. The PIN is written on the back in marker, or memorized, or kept in a notebook in the car.
Then the operator goes shopping. Not for groceries to eat. For groceries to resell.
On July 21, 2022, according to court filings, officers searched Fabritio Sardaru's vehicle. Inside, they found 353 cans of baby formula.
Picture it. Not one shelf. Not five shelves. Three hundred and fifty-three cans. A stockroom in a sedan. Baby formula resells well because it is expensive at retail, easy to move, and not perishable on a useful timescale. It is the kind of item a car can be filled with on Tuesday and emptied of by Friday.
On August 27, 2022, also per the DOJ release, Tomescu walked into a Sam's Club in Severn, Maryland, and rang up over $900 of a victim's SNAP benefits on Red Bull. Energy drinks. Pallets of cans. The same logic. Buy with stolen benefits. Sell to a corner store, a bodega, a wholesaler who does not ask. Pocket the cash.
Tomescu personally took, the prosecutors said, $7,457.50 out of the conspiracy. She is going to prison for 28 months for that figure.
IV.
This is where the machine becomes legible.
The skimmer is a tool. It is the same tool whether the card it is reading carries a paycheck, a tax refund, or a SNAP balance. What makes SNAP attractive to the operator is not that the technology is different. It is that the victim is different.
A bank customer who sees a fraudulent charge calls the bank. The bank reverses it within an hour, sometimes within minutes. The customer is annoyed. The customer is not hungry.
A SNAP recipient who sees a fraudulent charge calls a state office. Until 2022, there was no federal mechanism at all to replace stolen SNAP benefits. Congress changed that, briefly. Maryland alone replaced more than $22.6 million in stolen benefits between October 2022 and December 2024, according to state figures. The replacement program has since been allowed to lapse and revived in pieces, depending on the appropriations cycle.
The operator knows this. That is the whole reason the operator picks the SNAP card over the debit card sitting next to it in the same wallet on the same belt. The friction of recovery is the feature. The mother on hold for four hours is the business model.
That is not opportunism. That is design.
V.
The investigation that ended in Judge Rubin's courtroom involved the USDA Office of Inspector General's Northeast Region, the Montgomery County Police Department, the Howard County Police Department, and the Maryland Department of Human Services Office of Inspector General. Federal, state, county. The case crossed five state lines. It took roughly four years from the 2022 vehicle search to the 2026 sentencing.
Two people went to prison. The skimmer is still cheap. The blank cards are still a dollar. The magnetic stripe on the EBT card is still a 1985 hotel key. The next operator is already in a parking lot somewhere, snapping a piece of plastic onto a terminal at a grocery store that has not been checked since the manager came on shift.
The fifteen Maryland victims are not named in the public record. They do not give interviews. They do not testify on cable. They went to a store, swiped a card, and got nothing, and then they figured out how to feed their kids that week anyway, because that is what they were already doing.
Tomescu took $7,457.50. She got 28 months. Sardaru got two years. The skimmer is still on the counter.
That is not the end of the case. That is the case running again, under new names.
- U.S. Attorney's Office, District of Maryland | April 29, 2026 | Press release on sentencing of Maria Roza Tomescu
- U.S. Attorney's Office, District of Maryland | March 9, 2026 | Press release on sentencing of Fabritio Sardaru
- Baltimore Sun | April 29-30, 2026 | "Woman sentenced in SNAP fraud scheme that hit Maryland"
- USDA Office of Inspector General, Northeast Region | investigation record
- Maryland Department of Human Services | benefit replacement figures, October 2022 - December 2024
- U.S. District Court for the District of Maryland | sentencing record before Judge Julie R. Rubin
Editorial Notice
MarkTell is a true crime publication about financial fraud. Some scenes, dialogue, and sequential details are reconstructed from court filings, enforcement actions, news reports, and public records. Where the public record does not provide exact details, editorial reconstruction is used to convey the documented pattern of events. Names of private individuals may be changed to protect identity. All factual claims are sourced to public documents cited in the Evidence Trail above. MarkTell does not provide investment, legal, or financial advice. Nothing published here constitutes a recommendation to buy, sell, or avoid any investment. Allegations described in active cases have not been adjudicated and defendants are presumed innocent until proven guilty. Readers should conduct their own due diligence before making financial decisions.