PROVIDENCE, R.I. (WPRI) — Six people are facing charges for their alleged roles in a card-skimming scheme that targeted shoppers and ATM users in at least six states, the U.S. Attorney's Office announced Tuesday.

The group is accused of installing devices that steal victims' card information on ATMs and at retail stores, primarily on self-checkout terminals. From there, they would use that data to create counterfeit cards, then use those to make purchases and withdraw money from bank accounts.

In total, the suspects withdrew more than $300,000 from victims' accounts, according to a press release. The number of fraudulent purchases made has not yet been determined.

The investigation began in Oct. 2023 when a skimming device was found on a drive-through ATM at Bank Newport in Bristol.

Surveillance footage showed two men placing and later removing the device at the bank, and at least one of the men was seen doing the same at retail stores in September and December 2023.

A fraud and security officer from Bank Newport told federal prosecutors that 96 customer cards were compromised at that branch, while another 12 were compromised at the Warren branch, according to court documents. Twenty-two customers of the Warren branch reported unauthorized transactions totaling nearly $18,000.

Investigators said skimming devices were also discovered on two Westerly Community Credit Union (WCCU) ATMs in Westerly. One of the suspects was reportedly seen installing a device on Dec. 15, 2023, and an unknown man removed it later that day.

WCCU reported that $117,050 in unauthorized withdrawals got removed from 20 compromised accounts within three hours on Dec. 17, 2023, court documents show. That same day, $30,000 was withdrawn from eight accounts at a WCCU location in Wakefield.

Court documents state that devices were also found at 22 BJ's Wholesale Club locations in Rhode Island, Massachusetts, Maryland, New York, New Jersey, and Virginia, as well as some Walmart stores.

One or more members of the group were seen on surveillance video tampering with checkout terminals at BJ's and Walmart stores located in Coventry, Johnston and Warwick in Rhode Island and Avon, Raynham, Seekonk, and Walpole in Massachusetts between September and December 2023.

See affected stores below:

Nearly 5,000 credit/debit and EBT cards were run through payment terminals with skimmers at the Walmarts in Warwick and Coventry, the court affidavit said. Additionally, Walmart records showed more than 9,000 cards were used where the suspects installed skimmers at locations in Massachusetts.

The six suspects, hailing from California, are all foreign nationals who are in the country illegally and have prior run-ins with the law, according to federal prosecutors.

One instance shows three of the suspects placing a skimming device over a self-checkout register at the Coventry Walmart in September 2023.

The U.S. Attorney's Office said the trio was also seen using an EBT card cloned from a Warwick shopper at a Walmart in Pennsylvania, verified through receipts provided by the company.

Security footage showed members of the group installing skimming devices and making purchases on several occasions in various BJ's Wholesale Club and Walmart stores.

Prosecutors said there's probable cause that the six individuals knowingly conspired to commit bank fraud from approximately May 2023 to April 2024.

Isabela Ignat Codreanu, 23, and Mila Ciuciu, 20, are both Romanian citizens and charged with conspiracy to commit access device fraud.

Robby Vicson Codreanu, 20, a citizen of Great Britain, faces the same charge.

All three were due to appear in court Tuesday, according to the U.S. Attorney's Office.

Armando Ion Codreanu, 23, a citizen of Ireland, is scheduled to appear in court Wednesday on charges of conspiracy to commit access device fraud, conspiracy to commit bank fraud, and aggravated identity theft.

Nicolas Longin Codreanu, 21, a citizen of both Ireland and Romania, faces the same three charges. He is currently in the custody of U.S. Marshals and will face a judge on Thursday.

The court issued an arrest warrant for 37-year-old Ionut Zamfir, a Romanian citizen, on those three charges.

Through financial reviews, federal prosecutors identified multiple ATM cash deposits and Zelle money transfers sent among some of the suspects. A review of Nicolas Longin Codreanu's account showed more than $225,000 in deposits, while a review of Isabela Ignat Codreanu's account revealed more than $219,000 in deposits in 2023, per the affidavit.

If you suspect you have been impacted by skimming devices, U.S. Attorney Zachary Cunha said to first reach out to your bank and then contact your local police department.