Arrest documents allege that three Dallas men worked together to install malware on a bank ATM in Tyler for financial gain in December. An investigation by the Texas Financial Crimes Intelligence Center also found they are connected to multiple similar schemes across Texas and other states.
Mickael Toloza Parra, 32, Luis Oviedo Rico, 34, and Elvis Oviedo Rico, 30, all of Dallas, are being held in the Smith County Jail on charges of engaging in organized criminal activity in connection with a Dec. 19 incident at a Southside Bank location in Tyler. The Oviedo Rico brothers were arrested Jan. 30 and remain jailed on $1 million bonds. Toloza Parra was arrested March 30 and remains jailed on a $1.5 million bond.
According to arrest affidavits, the three men participated in a cyber-physical crime known as “jackpotting,” which is typically carried out by organized criminal groups. In these schemes, suspects install malicious software or hardware onto an ATM’s hard drive or computer system. Criminal associates located outside the country then remotely intercept and redirect electronic signals from the ATM, causing the machine to approve transactions it would not normally authorize. The stolen funds are ultimately transferred to criminal associates outside the United States.
The documents state that during the overnight hours of Dec. 19, 2025, suspects opened the ATM enclosure, removed the internal hard drive, and installed a device designed to intercept signals and redirect them to remote partners. Surveillance video captured a vehicle approaching the ATM and individuals opening the machine.
Through the Texas FCIC investigation, a vehicle registered to Elvis Oviedo Rico was identified as a suspect vehicle and was used as a “lookout vehicle” during the criminal activity. The investigation led to the arrests of Elvis Oviedo Rico and Luis Oviedo Rico, who investigators linked to nearly identical offenses in Texas and other states dating back to September 2025, according to the affidavit.
The special agent investigating the case learned of an individual operating under the codename “El Mecanico,” or “The Mechanic,” who allegedly coordinated the jackpotting offenses through WhatsApp group chats. Another alleged accomplice in similar schemes was determined to be connected to and photographed with “El Mecanico,” including during a jackpotting offense at Cherokee County Federal Credit Union in Jacksonville. Documents state that $160,959 was fraudulently withdrawn from that ATM, according to the affidavit.
The investigator recognized the suspect involved in the Cherokee County Federal Credit Union incident as the same individual from the Southside Bank case. An accomplice cooperating with investigators provided a phone number allegedly linked to “El Mecanico,” which was later determined to belong to Toloza Parra. Using still images and comparison analysis, the investigator identified Toloza Parra as a suspect in the Southside Bank incident, according to court documents.
