After nearly a decade, a cyber heist at an ATM kiosk near Althara Junction is once again in the spotlight. On Wednesday, a legal official attached to the 2016 case received a notice from the UK Red Warrant division seeking a report on Constantine Christian Victor, one of the accused. He has reportedly been traced in the UK, and extradition proceedings are underway to bring him to India.
The case
The customers who used the said ATM in the first week of August 2016 began reporting unauthorised withdrawals. At first, it seemed like a technical glitch or maybe even a routine fraud. But as complaints poured in, police realised that something big was in play.
Early investigations revealed that more than two dozen bank users had fallen victim to card skimming — a method where fraudsters use hidden devices to capture card data and pin numbers. In this case, a cloning device had been fitted inside the ATM, along with a pinhole camera that discreetly recorded keystrokes. The stolen data was transferred wirelessly and used to create duplicate cards with which money was withdrawn from various locations.
Within days, the police arrested Ilie Gabriel Marian from Mumbai. He was brought to Thiruvananthapuram and identified as one of the main accused. CCTV footage from the Althara ATM showed Marian and two others attaching a router and other electronic equipment to the machine.
The state police’s Cyberdome wing, working with technical experts from Technopark, tracked the gang’s movements and gathered crucial digital evidence. The then state police chief Loknath Behera described it as “one of the best-probed cybercrime cases” in Kerala’s history.
“This was a first-of-its-kind case in Kerala. We had to adapt quickly, coordinate with global agencies, and depend heavily on digital forensics. The Interpol alert helped us track down one of the accused in Nicaragua, who was later handed over to us. The case even received an award from Nasscom as the best investigated cybercrime case,” Behera tells TNIE.
Marian was the only one among the six accused to face trial. The rest — all from Romania — remain absconding. Police did manage to get custody of Ianut Alexander Marino, identified as the kingpin of the gang, after Interpol facilitated his detention in Nicaragua in 2018. However, he later fled the country after securing bail.
According to police sources, the gang had arrived in Thiruvananthapuram on July 8, 2016, and targeted the ATM for its low surveillance. Over `3.5 lakh was withdrawn using cloned cards. They had also attempted similar strikes at other kiosks in the city. Investigators believed the group had chosen Indian cities with weaker ATM security, making the Althara heist part of a larger network of cyber frauds across the country.
The incident marked Kerala’s first major brush with international cybercrime. It prompted an Interpol alert, drew national attention, and forced banks to tighten ATM security.
‘A tough trial’
The case was split into seven FIRs, each covering specific instances of unauthorised transactions and data theft. Marian was convicted under the IT Act but acquitted of forgery charges under the IPC. The trial stretched nearly four years, with frequent adjournments, difficulties in bringing expert witnesses, and complex coordination with central agencies.
The special public prosecutor Dileep Sathyan, who appeared for the case, described it as one of the toughest trials of his career. “It went on for 44 months, including the Covid period. It was hard to bring witnesses. Seven cases were being heard together. But we proved the charges under Sections 66 and 43 of the IT Act,” he says.
Though the sentence was relatively short, Marian had already spent enough time in custody to walk free once the verdict was delivered.
What now?
On Victor’s extradition to India, the legal official says, “Once procedures are completed and the accused is brought back to the state, the pending charges will be reopened and will be produced before the court.”
“Since he was absconding during the initial proceedings, a separate trial process will follow, which may include custodial interrogation and framing of charges,” he adds.
Even today, the Althara ATM heist remains a turning point in Kerala’s digital security landscape. It exposed glaring vulnerabilities in ATM infrastructure and forced financial institutions to take cyber threats seriously.