Is it legal to photograph and test ATMs?

Question

Some online company asked me do a job like this

We have a special task for you! Our analyst department collects information regarding Bitcoin ATMs across different states and cities. In most cases, the BTC ATM map doesn’t demonstrate the reality of available working ATM machines - especially in Canada territory. You will have to visit the ATM machine at the provided address, take pictures of the location and provide us the report.

The following is a checklist for your activity:

1. Visit the Bitcoin ATM machine at the following address: [address removed]

2. Ensure that the ATM is working; press a few buttons to make sure the ATM is responsive.

3. Grab a picture of the ATM machine, ensuring the machine model is visible.

4. Fill out the attached form and send it back together with a photo report.

Is this type of work legal?

Answer 1

Legal? Maybe. Legitimate? Absolutely Not.

I'm not qualified to guess whether documenting the make, model and location of ATMs is technically legal in your jurisdiction. A list like that isn't something I would want found in my possession during a police search though.

However, I can say without a doubt: This information is not being gathered for legitimate reasons.

The most likely use for this information is for the installation of ATM skimmers. Surveillance or dummy devices that can be installed into ATMs to collect account and PIN information from unsuspecting users.

Some key red flags:

• Need to ensure the machine model is visible. Many skimming devices are make/model specific so including this information will allow them to have the correct parts on hand.
• Anyone with a legitimate use for this information would already have it. Owners, operators and repairmen for these ATMs would all already have access to this information through legitimate channels without requiring you to walk around and collect it.
• Vague description of reasons. Some online company said "our analyst department", what do they analyse, who for?
• "We have a special task for you!" If this doesn't scream scam, I don't know what does. What real job opportunity opens like that?

Overall this is absolutely a scam for others if not for you and is possibly illegal. Stay as far away from it as you can.

Answer 2

In addition to skimmers, another reason to have photos like this is that some ATMs are poorly secured. A surprisingly common type of theft is to steal the whole ATM. Banks are poor targets as their external ATMs are typically big and bulky. ATMs in stores, however, are often small and only bolted down. Stealing the whole machine can net you thousands of dollars in cash. There's whole crime rings that do this (emphasis mine)

They are after automated teller machines. Not the PIN codes of legitimate customers, not cloned debit cards, but the whole machine, from keypad to cord.

All told, after six thefts and three failed attempts, the crew has stolen about $39,000.

So what does a "Bitcoin ATM" look like? Oh, it looks exactly like the ones that get stolen

Now, the police are going to start reviewing footage of security cameras after the thefts and some guy walking around the now-stolen ATM taking pictures is going to look pretty suspicious, especially if you've been doing this on a frequent basis. Depending on the jurisdiction, they could charge you as an accessory to the crime (even if you claim ignorance and show them the email).

Answer 3

I think it's a simpler scam

And I'm sure of that because they want Bitcoin ATMs specifically.

Scams work in small steps.

Right now, the instruction is to go out and take photos of the ATM machines and gather data. They have no real interest in the data; it's just busy-work to build up your confidence.

Later, the instruction will be to deposit cash into the ATM, to confirm that the ATM machine is functioning. Cash will be sent to the scammer's Bitcoin account, of course.

The source of this cash will be the cashier's check or bank transfer they will send you, which covers both your salary and the "test deposits".

They may "accidentally" send you too much money; but since you're making test deposits anyway, just return the excess money that way.

This is a remix of the classic overpayment scam: they send you "too much money" and have you send some of it back. They send you the money via a reversible method (fake cashier's check; bank transfer) then have you send the money back via an irreversible method such as Western Union or ... ... wait for it ...

Bitcoin ATM.

Usually that reversible payment to you reverses, and you wind up holding the bag. But sometimes the payment is valid currency but is tainted because it traces back to a crime; you just helped them launder that money. Same difference in the end; authorities catch up with you and seize the money back.

So right now, you're in phase 1 of the scam: the task to simply find, test and photograph the ATM machine is to get you comfortable with the idea of manipulating the machine as part of your 'employment'. So it will seem perfectly natural to subsequently deposit money into the scammer's account with it.

The money they send you will reverse or bounce, of course; you will be out the money you sent onward; that's the root of the scam.

Why don't I think it's a "case the joint for a bricks-and-mortar ATM robber" job? Real simple: they are wildly different criminal specialties. One gang lives 30 miles from you and is good at chaining ATM machines to stolen pickup trucks. That's not the same skill as making contacts with you anonymously so it can't be traced back to them. That skill more closely aligns with the skill of getting you bogus money that appears real. The sticky point for these scams has always been finding a stable, irreversible way to get you to send the extra money back; Bitcoin ATMs solve that nicely.

The other thing is, the pickup-truck gang (or the skimmer gang) would take many, many ATMs - there'd be no reason to have you drive right past 20 ATM machines at gas stations, pubs, and convenience stores to get to a Bitcoin ATM, specifically. I feel that alone proves my point. Besides, installing a skimmer or hauling off an ATM requires local people, and if they had local people, they wouldn't need you.

Answer 4

The answers stating that this is a bad idea or a scam might be missing something.

In the UK "secret shopping" is a legitimate thing and many companies rely on it to get feedback on the services they supply or gather market info etc. It may or may not be normal in Canada.

If I found this task on a secret shopper portal I wouldn't be alarmed. An app provider wanting to sanitise their data is a completely legitimate use of a secret shopper service.

The data you are gathering could be used for nefarious purposes, but that doesnt mean that this is a nefarious endeavor.

Answer 5

You need consent if you take (and publish) photographs of people for non-strictly-private purposes, or you are in violation of PIPEDA. You may not trespass when taking photographs of private property (but you may otherwise take photos). You may not violate copyright law of public performances and the like (such as, record a video of the movie in a cinema).

Now of course, ATMs are not people, and they are not public performances, and you are not trespassing in order to photograph that particular private property, so... strictly by the letter of the law, in Canada, you are free to photograph them. In theory. That doesn't mean it's a good idea, though!

In practice, this is almost certainly either the lead-in for a scam to follow as pointed out in Harper's answer, or information gathering for a future crime (break-in, stealing ATM, skimming cards, mugging clients, whatever).
For which you can, and likely will be (if caught, or identified) prosecuted for aiding and abetting (and, possibly, if you have assets that can be taken away from you, held liable for damages).

There is very little doubt that you should definitively stay away from this type of "work", as it reeks of trouble.

Imagine someone asked you to take photographs of the U.S. embassy, in particular of their security measures, their entrances, the parking lot, and so on. And, oh yes, you need to fill out a form where you record when the embassador comes and leaves, and when guard shifts change. Because, whatever, the company's analyst needs to know for a security audit, and for the, uh... guard union representative to make sure work time laws are followed.
Would you think it's a good idea to do that? Would you, or would you not expect to be in serious trouble if the ambassador was shot three days later?

Answer 6

Going around verifying whether supposedly-extant Bitcoin ATMs in public places are actually present and apparently functional is not in and of itself illegal activity.

Some of these machines may not be in public places (for example, they may be in privately-owned stores or malls). In those cases, you would have to make sure that what you want to do is in line with the policies of the place in question. Calling up a store and asking if you can test their Bitcoin ATM on behalf of nearest-btc-atm.biz might be a better approach than walking in and weirdly fiddling with it without permission. Conversely, if you have permission from the venue, you can do more or less whatever you want.

Photography is an activity that may be heavily restricted in publicly-accessible but non-public places, and even in public it may not always be legal to e.g photograph a machine that is next to a piece of artwork, or which someone identifiable is standing in front of, without relevant permissions.

The fact that they want the models of the machines is somewhat suspicious; that's not information you would need to maintain in a public database for people looking for the machines, but it is information you would want if you planned to tamper with them. You should check to see if they want you to report on the brand of the machine (so that they know who operates it and what its capabilities are), or if they want the exact model number, hardware revision, or serial number of the machine (so they know whether they can hack into it using some tool they have developed). And if you know or suspect it is the latter, it may be illegal for you to help them.

You could also check to see if they are gathering this information to somehow facilitate their own money laundering (by driving around to all the machines and depositing a small amount through each, for example). If the people you would work for maintain a public database and want to improve its accuracy, that is unlikely. If they are assembling a private database and won't explain why, that is suspicious. (And if you suspect you might be helping to commit a crime, again, it may be illegal for you to do whatever it is you are being asked to do.)