60

Some online company asked me do a job like this

We have a special task for you! Our analyst department collects information regarding Bitcoin ATMs across different states and cities. In most cases, the BTC ATM map doesn’t demonstrate the reality of available working ATM machines - especially in Canada territory. You will have to visit the ATM machine at the provided address, take pictures of the location and provide us the report.

The following is a checklist for your activity:

  1. Visit the Bitcoin ATM machine at the following address: [address removed]

  2. Ensure that the ATM is working; press a few buttons to make sure the ATM is responsive.

  3. Grab a picture of the ATM machine, ensuring the machine model is visible.

  4. Fill out the attached form and send it back together with a photo report.

Is this type of work legal?

  • 13
    Legality depends on the jurisdiction, so it's absolutely unanswerable without than information. But in any case, just WTF are "Bitcoin ATMs"? – jamesqf Feb 12 at 18:08
  • 11
    @jamesqf it's an ATM where you can buy bitcoin by depositing cash, sell bitcoin for cash etc. There's a picture of one in Machavity's answer – Alexandre Aubrey Feb 12 at 19:53
  • 3
    1. I have never thought of a bitcoin vending machine as an "ATM", and now I wonder if legally it can be considered such, 2. "ATM machine" is redundant, and 3. Are they offering to pay in bitcoin? – Michael Feb 12 at 20:14
  • 2
    @Alexandre Aubrey: So it might more accurately be called a Bitcoin vending machine, no? – jamesqf Feb 13 at 2:37
  • 2
    What makes you think it could be illegal? What law would you presumably violate? No ATM upskirting? – Peter - Reinstate Monica Feb 13 at 16:57
140

Legal? Maybe. Legitimate? Absolutely Not.

I'm not qualified to guess whether documenting the make, model and location of ATMs is technically legal in your jurisdiction. A list like that isn't something I would want found in my possession during a police search though.

However, I can say without a doubt: This information is not being gathered for legitimate reasons.

The most likely use for this information is for the installation of ATM skimmers. Surveillance or dummy devices that can be installed into ATMs to collect account and PIN information from unsuspecting users.

Some key red flags:

  • Need to ensure the machine model is visible. Many skimming devices are make/model specific so including this information will allow them to have the correct parts on hand.
  • Anyone with a legitimate use for this information would already have it. Owners, operators and repairmen for these ATMs would all already have access to this information through legitimate channels without requiring you to walk around and collect it.
  • Vague description of reasons. Some online company said "our analyst department", what do they analyse, who for?
  • "We have a special task for you!" If this doesn't scream scam, I don't know what does. What real job opportunity opens like that?

Overall this is absolutely a scam for others if not for you and is possibly illegal. Stay as far away from it as you can.

  • 64
    One minor point: this is likely not a scam for OP, he very well may be paid in full and without complications. He might also be visited later by the police for aiding in a criminal enterprise tho – Hobbamok Feb 12 at 13:41
  • 21
    @Hobbamok I wouldn't consider scam to strictly mean "leaves you out of pocket", even if those are the most common. Being tricked into doing something illegal for somebody else's gain, would still be a scam IMO. (Note, definition of a scam is just "a dishonest scheme" - it doesn't have to be money that goes missing) – Bilkokuya Feb 12 at 13:43
  • 18
    It's possible that a legitimate website wants to catalogue the locations of working Bitcoin ATMs. Especially given their rarity. It's also possible that they don't know what they're doing when it comes to hiring people. That said, do you want to work (even temporarily) for someone who doesn't know what they're doing? – user253751 Feb 12 at 14:16
  • 11
    Additionally, Bitcoin ATMs are not run by banks or councils and probably don't have dedicated repair technicians either. – user253751 Feb 12 at 14:17
  • 4
    @Will Perhaps it used to be reliable, and then it was forgotten about. Remember that everyone used to be talking about Bitcoin, and now they are not. – user253751 Feb 12 at 16:32
63

In addition to skimmers, another reason to have photos like this is that some ATMs are poorly secured. A surprisingly common type of theft is to steal the whole ATM. Banks are poor targets as their external ATMs are typically big and bulky. ATMs in stores, however, are often small and only bolted down. Stealing the whole machine can net you thousands of dollars in cash. There's whole crime rings that do this (emphasis mine)

They are after automated teller machines. Not the PIN codes of legitimate customers, not cloned debit cards, but the whole machine, from keypad to cord.

All told, after six thefts and three failed attempts, the crew has stolen about $39,000.

So what does a "Bitcoin ATM" look like? Oh, it looks exactly like the ones that get stolen

Bitcoin ATM

Now, the police are going to start reviewing footage of security cameras after the thefts and some guy walking around the now-stolen ATM taking pictures is going to look pretty suspicious, especially if you've been doing this on a frequent basis. Depending on the jurisdiction, they could charge you as an accessory to the crime (even if you claim ignorance and show them the email).

  • 52
    Based on working in the industry, I can tell you right now that if you walk up to an ATM, take pictures of it, and then poke at a few buttons but don't actually complete a legitimate transaction, you'll trigger automated fraud detection and people will be looking at your face in the security footage before the crime actually happens. – dwizum Feb 12 at 16:24
  • 5
    Stealing whole ATMs is somewhat common in my area. Thieves first steal a pickup truck, then drive the stolen truck to a convenience store, use the truck as a battering ram (rear first) to break into the store, hook up a chain to the ATM, use the truck to haul the ATM out of the store, throw the ATM in the bed of the truck, and drive off. The stolen truck is usually found sans ATM a few miles away. Don't worry, I'm not giving anyone any details that haven't already been in many news stories. – shoover Feb 12 at 17:53
  • 27
    @shoover America: Steal a pickup, smash window, pull ATM out with chain. Ireland: hold my beer – Machavity Feb 12 at 18:25
  • 10
    @dwizum, an interesting idea: the thieves may be asking their rube to push buttons without a card or transaction specifically to point fraud detection to that person and away from them... – spuck Feb 12 at 18:59
  • 12
    @spuck Yes, getting someone else to do your dirty work is a hallmark of many scammers. We've actually caught people carrying out this scam - "hire" someone to case an ATM and hand their research over to the person designing the actual scam. The poor sap who gets a visit from the police usually doesn't understand what the actual planned crime is. – dwizum Feb 12 at 19:02
24

I think it's a simpler scam

And I'm sure of that because they want Bitcoin ATMs specifically.

Scams work in small steps.

Right now, the instruction is to go out and take photos of the ATM machines and gather data. They have no real interest in the data; it's just busy-work to build up your confidence.

Later, the instruction will be to deposit cash into the ATM, to confirm that the ATM machine is functioning. Cash will be sent to the scammer's Bitcoin account, of course.

The source of this cash will be the cashier's check or bank transfer they will send you, which covers both your salary and the "test deposits".

They may "accidentally" send you too much money; but since you're making test deposits anyway, just return the excess money that way.

This is a remix of the classic overpayment scam: they send you "too much money" and have you send some of it back. They send you the money via a reversible method (fake cashier's check; bank transfer) then have you send the money back via an irreversible method such as Western Union or ... ... wait for it ...

Bitcoin ATM.

Usually that reversible payment to you reverses, and you wind up holding the bag. But sometimes the payment is valid currency but is tainted because it traces back to a crime; you just helped them launder that money. Same difference in the end; authorities catch up with you and seize the money back.

So right now, you're in phase 1 of the scam: the task to simply find, test and photograph the ATM machine is to get you comfortable with the idea of manipulating the machine as part of your 'employment'. So it will seem perfectly natural to subsequently deposit money into the scammer's account with it.

The money they send you will reverse or bounce, of course; you will be out the money you sent onward; that's the root of the scam.

Why don't I think it's a "case the joint for a bricks-and-mortar ATM robber" job? Real simple: they are wildly different criminal specialties. One gang lives 30 miles from you and is good at chaining ATM machines to stolen pickup trucks. That's not the same skill as making contacts with you anonymously so it can't be traced back to them. That skill more closely aligns with the skill of getting you bogus money that appears real. The sticky point for these scams has always been finding a stable, irreversible way to get you to send the extra money back; Bitcoin ATMs solve that nicely.

The other thing is, the pickup-truck gang (or the skimmer gang) would take many, many ATMs - there'd be no reason to have you drive right past 20 ATM machines at gas stations, pubs, and convenience stores to get to a Bitcoin ATM, specifically. I feel that alone proves my point. Besides, installing a skimmer or hauling off an ATM requires local people, and if they had local people, they wouldn't need you.

  • 2
    This type of scam is also sometimes known as a "washed cheque" scam. – Paul Belanger Feb 13 at 18:58
  • 3
    It's not necessarily just "busy work" - the scammers would want need to know which detailed step-by-step instructions to use for other victims in the area (or indeed for you!)... they can't use generic vague instructions like "do something like XYZ" or "in general, most machines follow a similar buying process" like the bitcoin how-to page linked in the answer from @Machavity because the scammers don't WANT victims who understand what the machine is doing. They must be talked through step by step! – Steve Feb 14 at 10:53
5

The answers stating that this is a bad idea or a scam might be missing something.

In the UK "secret shopping" is a legitimate thing and many companies rely on it to get feedback on the services they supply or gather market info etc. It may or may not be normal in Canada.

If I found this task on a secret shopper portal I wouldn't be alarmed. An app provider wanting to sanitise their data is a completely legitimate use of a secret shopper service.

The data you are gathering could be used for nefarious purposes, but that doesnt mean that this is a nefarious endeavor.

  • 7
    facepalm secret shoppers are usually fake too, at best they are sales come-ons to get you to buy stuff. The function that secret shopping provides (companies auditing their retail staff) are done by vetted staff or competent contractors, not random citizens who sign up for a website. Not least so they get reports which are consistent. – Harper - Reinstate Monica Feb 13 at 18:18
  • 3
    Is it personal experience that leads you to that conclusion? I did quite a lot of "secret shopping" when I was a student, I don't recall ever having any issues. Payment was usually predicated on a pre-agreed measure of quality in the reporting. I also had to prove I could make good quality sound, video, image recordings before being able to accept certain tasks. I can only speak for the UK, and from my personal experience but "usually fake" seems rather strong. – James B Feb 13 at 18:26
  • 1
    Well, attributing legitimacy to OP's deal when it's so obviously a scam is also ... rather strong. – Harper - Reinstate Monica Feb 13 at 18:33
  • 1
    I think the answer here is unlikely to be accurate in this instance, but I don't disagree with it in principle. We have mystery shoppers / secret shoppers in the US as well, and it is a significant industry; while there are illegitimate ones, there are also very much legitimate ones - I worked in retail management for years and we had a few visits a quarter from secret shoppers typically. It's not wrong to both say OP is probably a scam, and if OP left out a lot of relevant information that it might not be one. – Joe Feb 13 at 21:50
  • 2
    Joe, Harper, thanks for your input. My answer was given by way of balance, because with the information given by OP there is a potentially legitimate reason for an "online company" to post such jobs. Whether this specific instance is a scam or not I couldn't say, given the information at hand. – James B Feb 13 at 21:57
1

You need consent if you take (and publish) photographs of people for non-strictly-private purposes, or you are in violation of PIPEDA. You may not trespass when taking photographs of private property (but you may otherwise take photos). You may not violate copyright law of public performances and the like (such as, record a video of the movie in a cinema).

Now of course, ATMs are not people, and they are not public performances, and you are not trespassing in order to photograph that particular private property, so... strictly by the letter of the law, in Canada, you are free to photograph them. In theory. That doesn't mean it's a good idea, though!

In practice, this is almost certainly either the lead-in for a scam to follow as pointed out in Harper's answer, or information gathering for a future crime (break-in, stealing ATM, skimming cards, mugging clients, whatever).
For which you can, and likely will be (if caught, or identified) prosecuted for aiding and abetting (and, possibly, if you have assets that can be taken away from you, held liable for damages).

There is very little doubt that you should definitively stay away from this type of "work", as it reeks of trouble.

Imagine someone asked you to take photographs of the U.S. embassy, in particular of their security measures, their entrances, the parking lot, and so on. And, oh yes, you need to fill out a form where you record when the embassador comes and leaves, and when guard shifts change. Because, whatever, the company's analyst needs to know for a security audit, and for the, uh... guard union representative to make sure work time laws are followed.
Would you think it's a good idea to do that? Would you, or would you not expect to be in serious trouble if the ambassador was shot three days later?

0

Going around verifying whether supposedly-extant Bitcoin ATMs in public places are actually present and apparently functional is not in and of itself illegal activity.

Some of these machines may not be in public places (for example, they may be in privately-owned stores or malls). In those cases, you would have to make sure that what you want to do is in line with the policies of the place in question. Calling up a store and asking if you can test their Bitcoin ATM on behalf of nearest-btc-atm.biz might be a better approach than walking in and weirdly fiddling with it without permission. Conversely, if you have permission from the venue, you can do more or less whatever you want.

Photography is an activity that may be heavily restricted in publicly-accessible but non-public places, and even in public it may not always be legal to e.g photograph a machine that is next to a piece of artwork, or which someone identifiable is standing in front of, without relevant permissions.

The fact that they want the models of the machines is somewhat suspicious; that's not information you would need to maintain in a public database for people looking for the machines, but it is information you would want if you planned to tamper with them. You should check to see if they want you to report on the brand of the machine (so that they know who operates it and what its capabilities are), or if they want the exact model number, hardware revision, or serial number of the machine (so they know whether they can hack into it using some tool they have developed). And if you know or suspect it is the latter, it may be illegal for you to help them.

You could also check to see if they are gathering this information to somehow facilitate their own money laundering (by driving around to all the machines and depositing a small amount through each, for example). If the people you would work for maintain a public database and want to improve its accuracy, that is unlikely. If they are assembling a private database and won't explain why, that is suspicious. (And if you suspect you might be helping to commit a crime, again, it may be illegal for you to do whatever it is you are being asked to do.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.