Two men suspected of hacking into at least three Wyoming ATMs in mid-March are in custody in the Denver jail, waiting for extradition.
Yohandri Ramirez, 34, and Yonaiker Fernandez, 27, each face up to 70 years in prison if convicted of multiple felonies against them in Big Horn County, including felony theft, hacking, and conspiracy to commit theft.
They used sophisticated hacking tools to trick ATMs in Lovell, Greybull and Thermopolis to spit out a total of about $54,200 from March 15 to March 16, says an evidentiary affidavit by Wyoming Division of Criminal Investigation Special Agent Jonathan Shane Reece.
A 1999 Honda Odyssey van with Colorado plates pulled up to a Big Horn Federal Savings bank ATM in Lovell on March 15, says the affidavit. Ramirez, Fernandez, and “co-conspirators” used devices to manipulate the ATM’s software and steal about $24,700 before leaving in the van, says the document.
It’s called “jack potting,” Big Horn Federal Savings Bank CEO and President John Coyne III told Cowboy State Daily in a Monday interview.
“Basically, what they’re doing is breaking into the machines and changing out the hard drive, and providing software that puts the machine into a position where it dispenses the money in the cartridges,” said Coyne. He said investigators believe the heists started in the Billings, Montana, area before proceeding down through Wyoming.
Though the first alleged heist happened in the “wee hours” of the morning, the second two were more “brazen,” happening in broad daylight, noted Coyne.
The suspects pulled up to a Big Horn Federal Savings Bank ATM in Greybull on March 16 at about 2 p.m. and used devices again to manipulate the software, drawing about $19,500, according to the affidavit and Coyne’s recollection of the time of day.
Fernandez was driving, the affidavit says.
They stopped at a third ATM of the same bank chain, in Thermopolis at 7 p.m. that night and – again manipulating the software – drew about $10,000 before leaving in the van, says the document.
The Apartment
On March 18, Colorado and federal law enforcement found the Odyssey van at an apartment on Jewell Avenue, Denver, wrote Reece in the affidavit.
It says law enforcement personnel found Ramirez and Fernandez both there.
Ramirez “matched the description of a subject captured in surveillance video” during the heists, says the affidavit.
Fernandez looked like the driver, another affidavit from Fernandez’s case adds.
Reece’s account describes a coordinated effort with people acting as drivers, lookouts, software installers and other roles “acting as a team.”
Couple More
Greybull Police Chief Travis Davis said at least two more suspects were involved, though at this juncture he knew of just two in custody. Authorities are looking for others, he said.
The bank handed its video surveillance to the local investigators, who in turn gave them to the Wyoming Division of Criminal Investigation (DCI) for facial recognition investigation.
Authorities have been noting similarities between the March heists and another, similar incident in December, in which thieves pulled money from the Lovell ATM, said Davis.
That heist was of a “pretty small amount,” said Coyne in his own interview: “about a third of what (the suspects) got in this last one.”
Davis said the two incidents look similar because of their sophistication and coordination.
Big Horn County Sheriff Ken Blackburn praised the local police and DCI both, adding, “DCI did a lot of heavy lifting on this case.”
DCI did not immediately respond to a Monday email request for comment.
“(We’re) super excited that the local police departments and sheriff’s departments – in coordination with DCI and FBI – have already been able to make arrests,” said Coyne. “Because one of the concerns here is these guys are getting more brazen in their attempts.”
Coyne said ensuring “these bad guys can be identified and captured and detained is really important for us, to try to eliminate this thing from continuing to happen (and for) the duty we have as financial institutions to continue to protect our depositors’ money.”
Clair McFarland can be reached at clair@cowboystatedaily.com.
