Prosecutors say Gavril Sandu joined a “vishing” bank-fraud conspiracy by hacking VOIP systems to steal victims’ debit-card and PIN numbers. The indictment alleges the stolen information was used to create fraudulently obtained debit cards.

Federal prosecutors in the Western District of North Carolina allege that Gavril Sandu participated in an international “vishing” scheme designed to compromise bank customers’ payment credentials. The case stems from conduct tied to VOIP system intrusion, where the government says Sandu used a script and related techniques to obtain victims’ debit card and PIN information. According to the indictment, that data was then used to manufacture and deploy fraudulently obtained debit cards. The charging theory is that the phone-based fraud operation worked at scale against financial institution customers, with the attackers impersonating processes that pressured victims into disclosing sensitive payment data. As part of the alleged conspiracy, once the attackers had the cards and PINs, the fraudulent payment instruments could be used to move money through unauthorized transactions. Sandu was brought before the court following extradition from Romania, underscoring that the alleged fraud relied on cross-border cyber access and operational coordination. The DOJ announcement frames the matter as a bank-fraud case centered on voice phishing and credential theft.