Is it legal to photograph and test ATMs?

Question

Some online company asked me do a job like this

We have a special task for you! Our analyst department collects information regarding Bitcoin ATMs across different states and cities. In most cases, the BTC ATM map doesn’t demonstrate the reality of available working ATM machines - especially in Canada territory. You will have to visit the ATM machine at the provided address, take pictures of the location and provide us the report.

The following is a checklist for your activity:

Visit the Bitcoin ATM machine at the following address: [address removed]
Ensure that the ATM is working; press a few buttons to make sure the ATM is responsive.
Grab a picture of the ATM machine, ensuring the machine model is visible.
Fill out the attached form and send it back together with a photo report.

Is this type of work legal?

Legality depends on the jurisdiction, so it's absolutely unanswerable without than information. But in any case, just WTF are "Bitcoin ATMs"? — jamesqf, Feb 12 '20 at 18:08
@jamesqf it's an ATM where you can buy bitcoin by depositing cash, sell bitcoin for cash etc. There's a picture of one in Machavity's answer — Aubreal, Feb 12 '20 at 19:53
@Alexandre Aubrey: So it might more accurately be called a Bitcoin vending machine, no? — jamesqf, Feb 13 '20 at 02:37
What makes you think it could be illegal? What law would you presumably violate? No ATM upskirting? — Peter - Reinstate Monica, Feb 13 '20 at 16:57
You might want to clarify what "online company" is and how the solicitation came. Email? Mechanical Turk site? Online jobs board? — Joe, Feb 13 '20 at 21:52
Since you have the address of the target machine, I recommend warning the owner that someone appears to be targeting their machine for some reason. — bta, Feb 13 '20 at 21:58
@Peter-ReinstateMonica Some places have surprisingly strict laws about photographing or recording certain things. I don't think that's usually the case in Canada, though. — reirab, Feb 14 '20 at 15:38
@jamesqf and ATMs could be called "cash vending machines". You can also sell bitcoin for cash at bitcoin ATMs and some even let you transfer bitcoin from one account to another. I think the term "ATM" is appropriate since it does more than just sell bitcoin and that's what it physically resembles. — Aubreal, Feb 14 '20 at 17:53
This question belongs on https://law.stackexchange.com/ since it's about legality of this action and is only tangentially related to personal finance or money. — Ian MacDonald, Feb 14 '20 at 18:09

score 142 · Accepted Answer · edited Jun 16 '20 at 10:49

142

Legal? Maybe. Legitimate? Absolutely Not.

I'm not qualified to guess whether documenting the make, model and location of ATMs is technically legal in your jurisdiction. A list like that isn't something I would want found in my possession during a police search though.

However, I can say without a doubt: This information is not being gathered for legitimate reasons.

The most likely use for this information is for the installation of ATM skimmers. Surveillance or dummy devices that can be installed into ATMs to collect account and PIN information from unsuspecting users.

Some key red flags:

Need to ensure the machine model is visible. Many skimming devices are make/model specific so including this information will allow them to have the correct parts on hand.
Anyone with a legitimate use for this information would already have it. Owners, operators and repairmen for these ATMs would all already have access to this information through legitimate channels without requiring you to walk around and collect it.
Vague description of reasons. Some online company said "our analyst department", what do they analyse, who for?
"We have a special task for you!" If this doesn't scream scam, I don't know what does. What real job opportunity opens like that?

Overall this is absolutely a scam for others if not for you and is possibly illegal. Stay as far away from it as you can.

edited Jun 16 '20 at 10:49

Community

1

answered Feb 12 '20 at 02:50

linksassin

772
1
6
9

69

One minor point: this is likely not a scam for OP, he very well may be paid in full and without complications. He might also be visited later by the police for aiding in a criminal enterprise tho – Hobbamok Feb 12 '20 at 13:41
24

@Hobbamok I wouldn't consider scam to strictly mean "leaves you out of pocket", even if those are the most common. Being tricked into doing something illegal for somebody else's gain, would still be a scam IMO. (Note, definition of a scam is just "a dishonest scheme" - it doesn't have to be money that goes missing) – Bilkokuya Feb 12 '20 at 13:43
20

It's possible that a legitimate website wants to catalogue the locations of working Bitcoin ATMs. Especially given their rarity. It's also possible that they don't know what they're doing when it comes to hiring people. That said, do you want to work (even temporarily) for someone who doesn't know what they're doing? – user253751 Feb 12 '20 at 14:16
12

Additionally, Bitcoin ATMs are not run by banks or councils and probably don't have dedicated repair technicians either. – user253751 Feb 12 '20 at 14:17
2

@user253751 That's what I was thinking too. Like it does seem like locating Bitcoin ATMs is actually something that is useful in general. That said, doing it as a job is suspicious, along with requiring pictures and a written report is pretty deep into red flag territory. I would be less skeptical of a company saying "Hey, we are trying to improve our bitcoin ATM map, if you know any in the area please let us know". Them offering money for a written report with pictures is where it gets pretty suspicious. – JMac Feb 12 '20 at 14:22
2

@JMac If there were lots of broken Bitcoin ATMs around (don't know if that's actually the case) then it would be reasonable to test them. And maybe some models of Bitcoin ATMs have known problems or quirks. I don't think this is obviously a scam / criminal activity, but it's not obvious legit either. – user253751 Feb 12 '20 at 14:26
@user253751 why would premises owners invest in a machine that serves an already narrow niche if it didn't at least do its job reasonably reliably? – Will Feb 12 '20 at 16:31
5

@Will Perhaps it used to be reliable, and then it was forgotten about. Remember that everyone used to be talking about Bitcoin, and now they are not. – user253751 Feb 12 '20 at 16:32
@user253751 if the value proposition of the machine was reasonable enough to actually acquire the machine then its income or lack thereof ought to at least cover the cost of repair, or at a bare minimum remind the owner of the piece of junk taking up space on the premises. – Will Feb 12 '20 at 16:35
1

@user253751 in any case, there still isn't a plausible business case for collecting the photos of the ATMs. – Will Feb 12 '20 at 16:38
@Will What else would the owner possibly do with the piece of junk? – user253751 Feb 12 '20 at 16:39
@user253751 break it up for parts, if nothing else. We're talking about a secure, modern piece of financial services equipment, not, like, an umbrella. – Will Feb 12 '20 at 16:48
4

@Will I think you would be surprised at how reusable complex devices actually aren't. Sure, someone could repurpose it, but it would be harder than building whatever they were making from scratch. At best it can make a nice DEFCON talk ("How I hacked an ATM to dispense paper planes") – user253751 Feb 12 '20 at 16:51
2

What is all this about ATM skimmers? That's not really an issue with Bitcoin ATMs, which all use touchscreens and single-use QR codes. – Michael Hampton Feb 12 '20 at 20:14
3

I agree that this offer is almost certainly for nefarious purposes, but I got a similar one once that was legitimate. The major differences: 1) The information they wanted was stuff that would be useful to the average person, such as fees, network affiliations, and the like. 2) I wouldn't be given a list of known ATMs, but rather a list of places they thought might have one, and they'd pay for any others I found. 3) This was during the early dot-com era, when you couldn't just go to your bank's website and get a map. (I declined. $0.50/ATM wouldn't have covered the cost of gas.) – Mark Feb 12 '20 at 21:17
1

@MichaelHampton if you can buy bitcoins on it with a debit/credit card, then you can also skim that card. – llama Feb 12 '20 at 22:21
1

@llama Ok, good point. I've never heard of a Bitcoin ATM that accepted credit cards though. I'm not sure such a thing exists. They're so high risk that I can't imagine any operator even wanting it. – Michael Hampton Feb 12 '20 at 22:34
2

Is there also not the possibility that fake Bitcoin ATMs are a thing? If Bitcoin ATMs aren't run by banks, then I assume there would be an opening in the market for someone to verify that ATMs are legitimate. – Mars Feb 13 '20 at 03:56
4

I'd like to note that "Anyone with a legitimate use for this information would already have it. Banks, councils, ATM repair technicians would all already have access to this information through legitimate channels without requiring you to walk around and collect it." isn't very true. There's websites that document locations, features and models of cryptocoin ATMs, as they're significantly rarer than regular ATMs and have different limitations (some only allow buying BTC, some allow selling too etc etc). However, these websites rely on volunteer info afaik. – ave Feb 13 '20 at 12:08
Someone please fix the terrible typos .... – Cloud Feb 13 '20 at 12:41
@Cloud I fixed one minor typo, not sure what else you are referring to? – linksassin Feb 13 '20 at 23:54
One other red flag: the grammar used in the message (assuming it was copied verbatim into the question) is a little unusual. The notable absence of a couple of the's, along with the awkward phrase "demonstrate the reality of" sounds off. I would imagine (though can't verify since I don't speak French) that a French speaker would probably not leave off the's since French has its own direct equivalent (anybody able to confirm this?). And of course an English speaker wouldn't have written it that way. Not a dead giveaway on its own, but a red flag as to the message's true origin. – bob Feb 14 '20 at 17:11

score 65 · Answer 2 · edited Jun 16 '20 at 10:49

65

In addition to skimmers, another reason to have photos like this is that some ATMs are poorly secured. A surprisingly common type of theft is to steal the whole ATM. Banks are poor targets as their external ATMs are typically big and bulky. ATMs in stores, however, are often small and only bolted down. Stealing the whole machine can net you thousands of dollars in cash. There's whole crime rings that do this (emphasis mine)

They are after automated teller machines. Not the PIN codes of legitimate customers, not cloned debit cards, but the whole machine, from keypad to cord.

All told, after six thefts and three failed attempts, the crew has stolen about $39,000.

So what does a "Bitcoin ATM" look like? Oh, it looks exactly like the ones that get stolen

Now, the police are going to start reviewing footage of security cameras after the thefts and some guy walking around the now-stolen ATM taking pictures is going to look pretty suspicious, especially if you've been doing this on a frequent basis. Depending on the jurisdiction, they could charge you as an accessory to the crime (even if you claim ignorance and show them the email).

edited Jun 16 '20 at 10:49

Community

1

answered Feb 12 '20 at 15:52

Machavity

2,344
8
24

54

Based on working in the industry, I can tell you right now that if you walk up to an ATM, take pictures of it, and then poke at a few buttons but don't actually complete a legitimate transaction, you'll trigger automated fraud detection and people will be looking at your face in the security footage before the crime actually happens. – dwizum Feb 12 '20 at 16:24
6

Stealing whole ATMs is somewhat common in my area. Thieves first steal a pickup truck, then drive the stolen truck to a convenience store, use the truck as a battering ram (rear first) to break into the store, hook up a chain to the ATM, use the truck to haul the ATM out of the store, throw the ATM in the bed of the truck, and drive off. The stolen truck is usually found sans ATM a few miles away. Don't worry, I'm not giving anyone any details that haven't already been in many news stories. – shoover Feb 12 '20 at 17:53
28

@shoover America: Steal a pickup, smash window, pull ATM out with chain. Ireland: hold my beer – Machavity Feb 12 '20 at 18:25
10

@dwizum, an interesting idea: the thieves may be asking their rube to push buttons without a card or transaction specifically to point fraud detection to that person and away from them... – spuck Feb 12 '20 at 18:59
12

@spuck Yes, getting someone else to do your dirty work is a hallmark of many scammers. We've actually caught people carrying out this scam - "hire" someone to case an ATM and hand their research over to the person designing the actual scam. The poor sap who gets a visit from the police usually doesn't understand what the actual planned crime is. – dwizum Feb 12 '20 at 19:02
1

@MachavityBut, but !!! It had a ram raid defence rail! | They could have stolen a bigger truck! Beforah - and how are we going to get that in there? Oh. Just drop it on top and push it in. – Russell McMahon Feb 12 '20 at 22:34
@dwizum I've taken pictures of an ATM after it crashed and refused to return my card, so that I would have the details of the ATM where my card was eaten, in case this information was relevant. Am I on a police list now? – gerrit Feb 13 '20 at 08:59
1

@gerrit What he likely means is that the video alerts someone to review it. Unless that ATM was stolen later, it's unlikely you're on any police list – Machavity Feb 13 '20 at 13:27
2

Yes, I'm speaking from the context of the institution running the ATM reviewing footage tagged as unusual. I thought it would be clear that you won't actually be "in trouble" unless a crime happens. But - if there is a subsequent crime - your face is on record with the institution running the ATM and it will be trivial to hand it over to police. On the other hand - if you had a legitimate issue with the ATM and took a photo to help support troubleshooting the issue, that wouldn't be a problem, even if it triggered a review (because the staff doing the review likely know about your issue). – dwizum Feb 13 '20 at 14:15
1

thy steal JCBs around our way – WendyG Feb 13 '20 at 14:49
@Machavity not just Ireland. Something similar happened in the US where I grew up as a kid. It was a couple of drunk Good Old Boys; who never managed to figure out how to crack the ATM open before it was found and they were arrested. – Dan Is Fiddling By Firelight Feb 13 '20 at 16:27
@Machavity You were one comma away from admitting to be part of a crime ring! XD "(emphasis, mine)". – Gabriel Feb 13 '20 at 20:00
@shoover Speaking of lifting an ATM, don't forget public transportation: https://www.phillyvoice.com/video-nj-transit-rider-bus-atm-viral-jokes/ – Feb 13 '20 at 21:49
" people will be looking at your face in the security footage before the crime actually happens" => seems like a non-issue with the COVID pandemic. Just wear your mask and a baseball cap :) – JonathanReez Mar 24 '21 at 20:53

Harper - Reinstate Monica · Answer 3 · 2020-02-13T19:35:02.450

I think it's a simpler scam

And I'm sure of that because they want Bitcoin ATMs specifically.

Scams work in small steps.

Right now, the instruction is to go out and take photos of the ATM machines and gather data. They have no real interest in the data; it's just busy-work to build up your confidence.

Later, the instruction will be to deposit cash into the ATM, to confirm that the ATM machine is functioning. Cash will be sent to the scammer's Bitcoin account, of course.

The source of this cash will be the cashier's check or bank transfer they will send you, which covers both your salary and the "test deposits".

They may "accidentally" send you too much money; but since you're making test deposits anyway, just return the excess money that way.

This is a remix of the classic overpayment scam: they send you "too much money" and have you send some of it back. They send you the money via a reversible method (fake cashier's check; bank transfer) then have you send the money back via an irreversible method such as Western Union or ... ... wait for it ...

Bitcoin ATM.

Usually that reversible payment to you reverses, and you wind up holding the bag. But sometimes the payment is valid currency but is tainted because it traces back to a crime; you just helped them launder that money. Same difference in the end; authorities catch up with you and seize the money back.

So right now, you're in phase 1 of the scam: the task to simply find, test and photograph the ATM machine is to get you comfortable with the idea of manipulating the machine as part of your 'employment'. So it will seem perfectly natural to subsequently deposit money into the scammer's account with it.

The money they send you will reverse or bounce, of course; you will be out the money you sent onward; that's the root of the scam.

Why don't I think it's a "case the joint for a bricks-and-mortar ATM robber" job? Real simple: they are wildly different criminal specialties. One gang lives 30 miles from you and is good at chaining ATM machines to stolen pickup trucks. That's not the same skill as making contacts with you anonymously so it can't be traced back to them. That skill more closely aligns with the skill of getting you bogus money that appears real. The sticky point for these scams has always been finding a stable, irreversible way to get you to send the extra money back; Bitcoin ATMs solve that nicely.

The other thing is, the pickup-truck gang (or the skimmer gang) would take many, many ATMs - there'd be no reason to have you drive right past 20 ATM machines at gas stations, pubs, and convenience stores to get to a Bitcoin ATM, specifically. I feel that alone proves my point. Besides, installing a skimmer or hauling off an ATM requires local people, and if they had local people, they wouldn't need you.

This type of scam is also sometimes known as a "washed cheque" scam. — Paul Belanger, Feb 13 '20 at 18:58
It's not necessarily just "busy work" - the scammers would want need to know which detailed step-by-step instructions to use for other victims in the area (or indeed for you!)... they can't use generic vague instructions like "do something like XYZ" or "in general, most machines follow a similar buying process" like the bitcoin how-to page linked in the answer from @Machavity because the scammers don't WANT victims who understand what the machine is doing. They must be talked through step by step! — Steve, Feb 14 '20 at 10:53

score 5 · Answer 4 · edited Feb 14 '20 at 17:20

5

The answers stating that this is a bad idea or a scam might be missing something.

In the UK "secret shopping" is a legitimate thing and many companies rely on it to get feedback on the services they supply or gather market info etc. It may or may not be normal in Canada.

If I found this task on a secret shopper portal I wouldn't be alarmed. An app provider wanting to sanitise their data is a completely legitimate use of a secret shopper service.

The data you are gathering could be used for nefarious purposes, but that doesnt mean that this is a nefarious endeavor.

edited Feb 14 '20 at 17:20

GS - Apologise to Monica

29,974
8
93
119

answered Feb 13 '20 at 18:05

JNB

159
1

7

facepalm secret shoppers are usually fake too, at best they are sales come-ons to get you to buy stuff. The function that secret shopping provides (companies auditing their retail staff) are done by vetted staff or competent contractors, not random citizens who sign up for a website. Not least so they get reports which are consistent. – Harper - Reinstate Monica Feb 13 '20 at 18:18
3

Is it personal experience that leads you to that conclusion? I did quite a lot of "secret shopping" when I was a student, I don't recall ever having any issues. Payment was usually predicated on a pre-agreed measure of quality in the reporting. I also had to prove I could make good quality sound, video, image recordings before being able to accept certain tasks. I can only speak for the UK, and from my personal experience but "usually fake" seems rather strong. – JNB Feb 13 '20 at 18:26
1

Well, attributing legitimacy to OP's deal when it's so obviously a scam is also ... rather strong. – Harper - Reinstate Monica Feb 13 '20 at 18:33
1

I think the answer here is unlikely to be accurate in this instance, but I don't disagree with it in principle. We have mystery shoppers / secret shoppers in the US as well, and it is a significant industry; while there are illegitimate ones, there are also very much legitimate ones - I worked in retail management for years and we had a few visits a quarter from secret shoppers typically. It's not wrong to both say OP is probably a scam, and if OP left out a lot of relevant information that it might not be one. – Joe Feb 13 '20 at 21:50
2

Joe, Harper, thanks for your input. My answer was given by way of balance, because with the information given by OP there is a potentially legitimate reason for an "online company" to post such jobs. Whether this specific instance is a scam or not I couldn't say, given the information at hand. – JNB Feb 13 '20 at 21:57
@JamesB Another way this might be legitimate, especially since it's about BitCoin ATMs which are not overly common, is a website trying to provide reliable information about where usable BitCoin ATMs are for potential users of said ATMs. – Eric Feb 14 '20 at 17:08
Plus the instructions to OP don't have them using the ATM; it has them pushing buttons and relaying sensitive (and potentially illegal) info back to their contacts. So they're not even shopping in any reasonable sense of the word. They are however casing, which is much much closer to a criminal activity. – bob Feb 14 '20 at 17:25

score 2 · Answer 5 · answered Feb 14 '20 at 18:07

You need consent if you take (and publish) photographs of people for non-strictly-private purposes, or you are in violation of PIPEDA. You may not trespass when taking photographs of private property (but you may otherwise take photos). You may not violate copyright law of public performances and the like (such as, record a video of the movie in a cinema).

Now of course, ATMs are not people, and they are not public performances, and you are not trespassing in order to photograph that particular private property, so... strictly by the letter of the law, in Canada, you are free to photograph them. In theory. That doesn't mean it's a good idea, though!

In practice, this is almost certainly either the lead-in for a scam to follow as pointed out in Harper's answer, or information gathering for a future crime (break-in, stealing ATM, skimming cards, mugging clients, whatever).
For which you can, and likely will be (if caught, or identified) prosecuted for aiding and abetting (and, possibly, if you have assets that can be taken away from you, held liable for damages).

There is very little doubt that you should definitively stay away from this type of "work", as it reeks of trouble.

Imagine someone asked you to take photographs of the U.S. embassy, in particular of their security measures, their entrances, the parking lot, and so on. And, oh yes, you need to fill out a form where you record when the embassador comes and leaves, and when guard shifts change. Because, whatever, the company's analyst needs to know for a security audit, and for the, uh... guard union representative to make sure work time laws are followed.
Would you think it's a good idea to do that? Would you, or would you not expect to be in serious trouble if the ambassador was shot three days later?

score -1 · Answer 6 · answered Feb 14 '20 at 00:51

Going around verifying whether supposedly-extant Bitcoin ATMs in public places are actually present and apparently functional is not in and of itself illegal activity.

Some of these machines may not be in public places (for example, they may be in privately-owned stores or malls). In those cases, you would have to make sure that what you want to do is in line with the policies of the place in question. Calling up a store and asking if you can test their Bitcoin ATM on behalf of nearest-btc-atm.biz might be a better approach than walking in and weirdly fiddling with it without permission. Conversely, if you have permission from the venue, you can do more or less whatever you want.

Photography is an activity that may be heavily restricted in publicly-accessible but non-public places, and even in public it may not always be legal to e.g photograph a machine that is next to a piece of artwork, or which someone identifiable is standing in front of, without relevant permissions.

The fact that they want the models of the machines is somewhat suspicious; that's not information you would need to maintain in a public database for people looking for the machines, but it is information you would want if you planned to tamper with them. You should check to see if they want you to report on the brand of the machine (so that they know who operates it and what its capabilities are), or if they want the exact model number, hardware revision, or serial number of the machine (so they know whether they can hack into it using some tool they have developed). And if you know or suspect it is the latter, it may be illegal for you to help them.

You could also check to see if they are gathering this information to somehow facilitate their own money laundering (by driving around to all the machines and depositing a small amount through each, for example). If the people you would work for maintain a public database and want to improve its accuracy, that is unlikely. If they are assembling a private database and won't explain why, that is suspicious. (And if you suspect you might be helping to commit a crime, again, it may be illegal for you to do whatever it is you are being asked to do.)

Is it legal to photograph and test ATMs?

6 Answers6

Legal? Maybe. Legitimate? Absolutely Not.

I think it's a simpler scam