CLEVELAND — Bob Boldin never expected to spend so much time on electronic benefits theft—a crime wave that’s leaving families hungry and costing taxpayers millions of dollars.
In Ohio, criminals have stolen more than $17.1 million from food-stamp, or SNAP, recipients since 2023. Boldin, the assistant agent in charge at the Ohio Investigative Unit’s office in Cleveland, is trying to chase those crooks down.
The agency enforces Ohio’s liquor and tobacco laws and has handled food-stamp fraud investigations for decades. Agents like Boldin work undercover. That’s why you won’t see his face in the images and video accompanying this story.
“We basically do all the vice work on behalf of the state of Ohio,” he said.
SNAP fraud investigations historically involved retailers who were selling ineligible items, like beer and cigarettes, or people who were trading cash for benefits.
But that’s changed dramatically. Now Boldin spends a lot of his time on skimming—cases where thieves put replica covers on payment machines at stores to steal EBT card numbers and PINs. Criminals then use that information to drain cardholders’ accounts.
“As technology changes, crime evolves,” Boldin said. “It’s really only been within the last year or two that we’ve taken a direct focus on skimming and other attacks on EBT cards. … When we started looking at the numbers, the staggering losses that were occurring through skimming and other fraud schemes were just overwhelming.”
RELATED: 'A failure of government.' As food-stamp theft soars in Lorain, experts say urgent help is needed
So far, the Ohio Investigative Unit has found 145 skimmers at 131 retail locations across the state. In January, the agency announced the indictment of a New York man accused of stealing more than $125,000 in benefits from Ohio families.
RELATED: Judge issues warrant for arrest of New York man accused of stealing Ohio SNAP benefits
Boldin can’t talk about his investigations. But he recently sat down with News 5 to discuss skimming, other SNAP theft schemes and ways that cardholders can protect themselves.
The following interview has been edited for clarity and length.
Michelle Jarboe: The people behind this have been described as sophisticated criminals. Is that an accurate portrayal?
Bob Boldin: This is complex fraud. This isn't go in and steal something and sell it through a traditional fence. Obtaining the EBT card data is complex. And then moving that card data. The fraud on the back end of it actually occurs out of state. In fact, it almost exclusively occurs out of state.
Those cards are being run in batches in other states, in New York, Chicago, California. So that information is moving.
Jarboe: What are these criminals doing at the other end?
Boldin: After the card data is stolen, the data is typically transferred to other bad actors. And I say typically, because it's not always the same.
We have bad actors that have placed skimming devices in Ohio, and then they've taken that card data themselves. And they've used it at other retailers in Ohio to make bulk purchases of Red Bull and Monster Energy drinks and baby formula and things like that.
Typically, though, that card data moves from the person who captured it or stole it to a bad actor on the retail side. How it gets there is a large part of the mystery. We know there's a lot of dark web activity.
There's even two or three different fraud techniques on the back end.
They'll take a legitimate retailer, and they'll clone their (Food and Nutrition Service) terminal number. Then they'll run a bunch of transactions of their own on that terminal number.
You'll see it where they clone the cards themselves, because these are mag-stripe cards.
RELATED: Ohio lawmakers introduce bill to add chips to EBT cards, to fight SNAP theft
You'll see where they'll take the card numbers, and they'll load them onto a bunch of blank card stock, and then just go into a retail premise. The retailer at that side of it has no idea whether or not it's a legitimate transaction.
You'll also see it where they're just sold in batches. Those card numbers can just be keyed into another terminal, without going through the extra step of producing a fake card.
RELATED: Thieves stole his SNAP benefits. Then they took his federal reimbursement, too.
Jarboe: It sounds like this is really evolving.
Boldin: It is. That is exactly the word. The crime trend in this has definitely evolved over the last couple years. We're trying to evolve with it. I think we're doing a good job of catching up, but that's kind of what we're doing. We're in a situation where they're a little bit ahead of us, and we acknowledge that. But we've closed that gap considerably over the last year.
Jarboe: Let's talk about other ways that criminals are getting this card information, because it sounds like it's not just skimming.
Boldin: It is definitely more than just skimming. Skimming is kind of a hot topic. It's talked about a lot right now, but it is, by far, not the only crime trend.
Surprisingly, there are still a lot of phishing scams. There are call centers just full of people calling EBT cardholders, telling them, “Hey, your card’s gonna get deactivated. You need to give us your 16-digit card number and your PIN.”
We still see text message scams. Those are known as smishing, where the recipient will get a text message, “Hey, your benefits are going to be deactivated within 24 hours if you don't provide us the verification that you're still in possession of the card. To verify that, you need to enter your 16-digit card number and your PIN.”
A lot of this information is transmitted by Bluetooth and Wi-Fi at the retailers. We know that there are attacks on those networks, as well, to intercept the card data in the middle of a legitimate transaction. For as many ways as you can think of that a bad actor would try to get someone's card number, there's a process where they're trying to do that.
Technology has advanced so much. Again, this is a 16-digit card number with a four-digit PIN code. And the reality is, right now the technology exists where it takes about a 10th of a second for a computer program to hack a four-digit PIN code.
Jarboe: So if you're an EBT cardholder, changing your PIN frequently is important, but it's not a fail-safe.
Boldin: It is important. We recommend it. They should change it monthly. The recipient knows when their load date is. They know when it's time, they're able to go back to the store and buy groceries. It's highly recommended that they change it just immediately prior to that card load every month.
Jarboe: What do you want people to know about the ConnectEBT app?
Boldin: The approach to stopping this fraud really is all-hands-on-deck. It takes everyone involved in the process, and that does start with the recipient. The ConnectEBT app allows the recipient to go in to lock and unlock their card. There's another feature in there where you can lock it for out-of-state transactions. That is a massive protection against fraud.
If you're a recipient and you're not traveling out of the state of Ohio, the smartest thing you can possibly do is lock your card for out-of-state transactions. The numbers that we've looked at over the last roughly two years show somewhere between $15 million and $20 million in suspected fraudulent transactions of Ohio recipients at out-of-state retailers.
You can lock and unlock that card at will, as many times or as often as you like. You can keep it locked until you're going to the store to make a legitimate purchase. The app has an option where it will allow it to automatically re-lock after 30, 60, or 90 minutes. You can pick the time frame, so that's just an extra protection and a convenience factor. You don't have to remember to go back in and lock it again.
The safest thing for a recipient to do is to utilize that app. And it is highly underutilized in the state of Ohio, so the message needs to get out there.
Jarboe: If EBT card holders suspect that they've been skimmed, who should they be talking to about it?
Boldin: Their first point of contact really needs to be their county job and family services office. That is the level one that can deactivate the card, get that recipient a new card issued, and stop additional fraud from potentially occurring on that card. They should contact their local law enforcement agency as well.
Jarboe: What other law enforcement agencies are you working with on this?
Boldin: We have tremendous partnerships with the local police departments and county sheriff's offices. We have partnered with many of those agencies in joint investigations.
We also work actively with a number of federal agencies. The Secret Service is highly involved because of the electronic crime nature of it and the transmission of financial data. And then, of course, we work very closely with the USDA Office of Inspector General. They are the federal agency that handles food stamp fraud investigations on behalf of the federal government.
It really is a joint effort across the board.
Jarboe: The federal reimbursement program for theft victims ended on December 20, and some folks I've talked to in the advocacy community are worried that theft victims will stop reporting because they can't get reimbursement. What are you seeing in terms of the volume of reports?
Boldin: There's an ebb and a flow to it. A lot of our bad actors, we believe, are transient. They'll move through an area and place a bunch of skimmers. Or that area's area code happens to get loaded into the call center this month for text message or phishing scams.
We'll go four or five, six weeks without really hearing anything, and then we'll go two months of very heavy activity.
RELATED: Federal repayment for stolen SNAP benefits is ending. But the problem is getting worse.
Jarboe: How can people protect themselves?
Boldin: Don't share your card number with anybody. Don't leave your card anywhere. If you have someone that goes shopping for you, that's an entirely different thing. But protect your card. Keep it safe. Keep it in your wallet. Keep it in your purse. Keep it out of view.
Set a complex PIN. PIN numbers can be hacked and cracked, but they're substantially easier when the pin is 1111. Change that pin regularly.
As far as the retail locations, the skimming devices themselves, they've become incredibly hard to detect. But there are still tells. There are still giveaways. Grab the device, shake the device. That device should be permanently mounted. Nothing should move.
The skimming devices, they are all overlays. They all have to attach in some manner to the top of the actual point of sale. Look for things that look out of place. Look for an edge that doesn't match. Look for an edge that's lifted or loose.
If you have a problem swiping your card. If it doesn't seem to go through the card swipe easily. It gets jammed, or it feels tight. It doesn't read on the first or second attempt. Those are things that the consumer can look out for.
Jarboe: There are a lot of different point-of-sale terminals. Are thieves coming up with these to replicate all those different types?
Boldin: Yes. For every point-of-sale in existence, there is a skimming device that mimics the exact layout, design, color of that device.
These devices used to store data locally. So they would have a memory card, like a flash drive for your old digital cameras. And that card typically could store up to about 250 EBT card numbers on it. But the bad actors would have to come back and physically take the device off to get all your card data.
These (new) devices are Bluetooth. So once I’ve placed that device on a point-of-sale, I don’t have to get closer than 20 feet away from it to pull all the data. I can go stand at the end of a cash register aisle and shop for a PayDay bar while I’m doing the Bluetooth on my phone and downloading all of that captured card data.
The device resets. It’s clean. It’s now got the same storage again. If someone doesn’t find it, I can come back a week later and download the next batch of card data that was taken.
Jarboe: Do you have any idea of what devices like this cost?
Boldin: I don’t. I know this – I’ll go ahead and say it because I don’t think I would be prohibited. They all come out of China.
Jarboe: What responsibility do retailers have here?
Boldin: That's part of the all-hands-on-deck, right? Recipients have their responsibility to help keep their card data safe. But the reality is, retailers are the point of attack. That is the vulnerable moment in this, where the transaction is occurring.
Retailers need to have their own steps in place. And many, many of them do.
Because some of the larger retailers have become so adept at looking for and detecting skimmers now, our bad actors are attacking mid-sized retailers, smaller retailers, mid-sized grocery markets, small convenience stores, point of sale terminals inside gas stations that are approved for EBT because the volume of food they sell.
As retailers have evolved in their prevention and detection, and as law enforcement has evolved, so have the criminals. They see what we're doing to observe and detect and prevent, and they make adjustments. So as they adjust, so will we.
Jarboe: What did you think when you first heard about this type of crime?
Boldin: Well, it's appalling. You know, the simple fact is, these people are attacking the most vulnerable of Ohio citizens, and it's just a disgusting concept.
Families with small children. Elderly recipients. We're talking about the people who need our help the most. There's a reason they receive these benefits, because they need them. They go to the store, and they're unable to buy baby formula and food for their children.
I interviewed one, 78 years old, who couldn't understand the concept of how this even happened but knew that when she went to the grocery store, she couldn't eat.
I think that's our responsibility, and that's our duty in this, to bring to justice people who are attacking Ohio's most vulnerable.
Jarboe: Do you think that we're going to be able to eradicate this problem?
Boldin: Eradicate is a strong word, right? I think we're going to impact it. I think we are impacting it. I think we're having an effect. Will we ever eradicate it? I'd love to say we would. I think that would make us all very happy. I don't know that we'll ever eradicate it, but I can tell you we will have an impact.
