6 ms·

Finds ATM skimmer in the wild, doesn't call the police. As a security professional I cringe at this sort of thing every time it happens. Fundamentally this is

Finds ATM skimmer in the wild, doesn't call the police. As a security professional I cringe at this sort of thing every time it happens. Fundamentally this isn't something to go reverse engineer, to show off to the person next to you to show how smart you are, it's evidence of a crime and needs to be handled as such by contacting the authorities. Perhaps there are fingerprints on the inside. Maybe the police have stopped someone who was suspicious around that ATM previously and would now have evidence to bring them in for further questioning. Maybe they could pull video. By not calling the authorities all of those potential angles to find the perpetrator are lost. Further, in many jurisdictions, not immediately calling the police can get you in a lot of trouble: 1) What if the police were watching, waiting for the criminal to return to remove it? You're now their prime suspect and a video of your 'discovery' isn't going to help you as you sit in jail for a few days. 2) This is directly tampering with evidence of a crime. Removing it is fine, that's discovery, but keeping it without contacting the authorities? That could be criminal.

tetrep 10y ago
While I don't think scaremongering is needed, I agree that it was a bad idea to just take the skimmer. It does interfere with legitmate police operations and could delay or prevent prosecution of the perpetrators.
tokensimian 10y ago
This assumes the police have competency, concern, and resources.
- patcheudor 10y ago
  So it's okay to: a) not report a crime & b) take evidence from the scene of the crime because the police likely don't care, are incompetent, and have no resources?
  - cle 10y ago
    What probably would have happened if the police were involved? This device would have been sealed in an evidence vault while the police investigate, and hardly anybody would ever know about it, whether these particular criminals were found or not. Instead, it's on the front page of Hacker News, and a LOT more people are aware of how sophisticated skimmers have become, and will be a lot more careful to check for skimmers on ATMs, and probably start warning family members and friends. IMO, this had a much more positive impact overall than anything the police would have done. But perhaps my opinion of police does not apply to Austrian police...
    - patcheudor 10y ago
      While waiting for the police there's nothing wrong with making a video. Taking it home to inspect it? That's something else entirely. In terms of this as valuable education, lets put our critical thinking hats on. Did this ultimately make the world safer and help real people? Likely very little because most people have zero liability for credit-card fraud and if we think through this a bit more maybe it makes the world more dangerous. What happens when someone who watched this video decides to do the same when they find a skimmer in Mexico, but someone from the local crime syndicate that placed it there see's them remove it, then follows them until they have a chance to take it back with force? Now someone gets hurt. In all cases, immediately call the police. EDIT: and if you don't trust the police, leave it, walk away, and anon call it in or call the bank.
      - cplease 10y ago
        I would agree it is completely stupid to remove and walk off with an ATM skimmer in a foreign country, all before calling the cops. There are so many ways that could end badly. There's nothing informative or educational that couldn't be shown by pictures or videos at the ATM and calling cops right away (the poster is now claiming he did call cops when he was able to get to a phone; this is still not impressive). However, this is an ATM skimmer + PIN cam. Not credit card fraud. Debit and ATM cards have much less protection. Consumers have 0 liability for CC fraud; when but your card is skimmed and PIN is stolen your checking account can get emptied, and you potentially have the burden of proving that it wasn't you using your card in a card-present, PIN transaction.
jliptzin 10y ago
In practice though I think it's actually better to warn the public about this so they're aware and can check for themselves. Every single time I contacted the authorities in my entire life (in one instance a pretty significant crime) it turned out to be a huge waste of my time.
- passivepinetree 10y ago
  Could you give an example or two and some specific reasons why? I don't doubt you at all; I'm just interested.
  - seanp2k2 10y ago
    I've had similar experiences. In one example, an uninsured driver backed up into my car as we were leaving a gas station. The driver was obviously intoxicated (seemed like high on marijuana, the smell was quite strong). I asked for their insurance, they said they had none, and said "please don't call the police". They then got back in and drove away. At this point, the station attendant comes out and says that he has video cameras and the tape and that he saw what happened and would do whatever he could to help. I called the police and all they cared about was "was anyone injured? No? Then we're not coming out. You can come here and file a police report if you want." They honestly didn't care about a hit-and-run with an uninsured driver who very likely had drugs on them. I filed a police report and got the damage looked at, and it was less than my deductible to repair, so I just ate it. Nothing ever happened with the police report. It also annoys me that this happened in my home town where the police absolutely love to sit at freeway exits where the service drive lane has a stop sign instead of a yield sign and write tickets all day for people rolling the stop signs, so I very much doubt that they have anything better to do, they just seem super lazy.
  - jliptzin 10y ago
    In one instance I was driving on the freeway in some traffic in the right lane and suddenly a huge 18 wheeler truck behind me starts honking the horn, I had no idea why. I creep up as much as I could as there was another car in front of me. The truck driver proceeds to rear end me. The first time I thought it was an accident, then he keeps doing it over and over again until I am finally in the shoulder. When I'm out of his way he starts driving away, I follow him to get his tag # and call the police. He did some pretty significant damage to my car. When they arrive to file the report they tell me there's 'nothing they can do' because the plates were out of state. They said they would file the report anyway. About a year later I shop around for car insurance and discover that the police report somehow indicated that the collision was my fault. Luckily the insurance company took a look at the damage and saw I was rear ended and concluded it probably was not my fault and removed it from my record.
forrestbrazeal 10y ago
If you load the comments on the article, the original author claims that he did in fact contact the Vienna Police Department. Whether he should have touched the skimmer at all is another question.
- deleted 10y ago
  [deleted]
- snsr 10y ago
  How would one determine that the device was, in fact, a skimmer without touching it?
  - Zuider 10y ago
    A quick visual inspection would reveal that the false card bubble with the skimmer installed was different in two significant ways. It was glued into place, while a real one would be embedded into the panel, and it was larger than the real one which was visible on the ATM to the left.
- collyw 10y ago
  It seems irresponsible not to remove it.
valine 10y ago
Perhaps I'm wrong about this, but I can't really imagine the police are well equipped to handle this sort of thing. I guess don't have much faith in the authorities when it comes to cyber crime. The police can only do so much. Giving people knowledge to protect themselves is far more beneficial imho.
- cisstrd 10y ago
  Watch a Crime Series like Forensic Files (even if the cases might be cherry-picked) and your attitude might change. Sure regarding technology they are not always up to industry standards, they might have to deal with too much workload, they might be under-funded, and someone working for the police will most likely not be smart enough to work for Google and earn 200000$ a year. But they can take fingerprints, they do have databases where they collect such information, they certainly can analyse video material, and it's stupid to think that in a country like Austria this won't be investigated (it's also Vienna we are talking about). Even if they just take some fingerprints, analyse the video material, maybe notify the bank and send out a memo, how is this not worth reporting it immediately?! The bank being notified can warn customers, change pins for customers they think might be victims, are paying more attention, ... I won't name other countries as I don't want to insult anyone, so let's just say in a "tourist-heavy corruption-ridden non-1st world country" I could sympathize a little bit more with your sentiment, but in this case I think you are just wrong and should re-think your attitude.
  - rjbwork 10y ago
    > But they can take fingerprints We've had a rash of car break-ins in my neighborhood. My roomate had a large metal ball hucked through his car window, and when the police called, the dude refused to bag it for evidence, take it with him, fingerprint it, or anything. I'd say to consider yourself lucky if your local beat police give a damn about collecting evidence of a crime that's not drugs, violence, or human trafficking. EDIT: Just remembered, instead, he picked up the metal ball and started tossing it around, from hand to hand, into the air, etc. All casual like - as if it were a toy. Callous disregard for his job and totally destroyed the evidence.
syngrog66 10y ago
In a world of only-smart-people: yes, I agree. In a world of mostly-dumb-people: no, I disagree. The overwhelming majority of my direct life experience, so far, to date, says we are awash in a world of dumb people. Therefore, I can't say I agree with you. "Report a vulnerability? They'll assume you are an evil attacker. Glance at a pretty girl? They'll assume you're an evil pedophile. Wear camo pattern pants? They'll assume you're an evil militant revolutionary gun nut freak mass murderer waiting-to-happen." Takeaway: The world in reality is very different than the world as it exists in your theory or ideal.
- snowwrestler 10y ago
  This is just self-serving rationalization for never doing anything. If you find a skimmer, call the cops. Even a dumb cop is not going to think you called them to remove and investigate your own skimmer.
  - syngrog66 10y ago
    never never NEVER underestimate the power/prevalance of dumb people in SF/Paris/London? sure, different in Kansas/rural/etc? see the first rule
  - syngrog66 10y ago
    > Even a dumb cop is not going to think you called them to remove and investigate your own skimmer. you might be so smart that you don't know what "dumb" means. I assure you: speaking after enough decades on this planet, that "dumb" means something which includes, at a minimum, totally lacking or ignorant in what a "smart" person might include as "common sense". speaking in broad strokes. any kind of phrase of "even a dumb person surely wouldn't do X, Y, Z" should be assumed false/wrong. otherwise "dumb" means nothing. again, speaking in broadstrokes, obviously. (again: for "smart" folks it should be obvious but to "dumb" folks may not be obvious. HN readership, however imperfect they may be, is overwhelmingly weighted towards the "smart" end.)
  - syngrog66 10y ago
    It is a world based on direct evidence. Not on theory or wishful thinking.
peletiah 10y ago
The Viennese police have sent out a warning on twitter and a press release shortly after this went public: https://twitter.com/LPDWien/status/745907477833719808 https://twitter.com/LPDWien/status/745907477833719808
hyperman1 10y ago
As there is a lot of distrust against the police in this thread, I'd like to share my experience with them in my home country, Belgium. In every case, they were professional, as human as possible, and did more than required form them in bad situations: * Suicide attempt by close relative: Police called us in the middle of the night after making sure immediate medical aid was given. They let us stay in the police night office until we could enter the hospital in the morning, gave us coffe, calmed us as much as possible. At that point the suicide attempt vs murder attempt part wasnt very clear and they could have treated us as potential murderers. * Unexpected death of another close relative in Holland: Both Belgian and Dutch police gave every help they could, even calling back the 2 cops from a day of who had found him in very messy circumstances (which explains the day off). Lots of legal wrangling because he died in another country, but they did everything they could and more. * Failure of a traffic light in heavy storm with zero visibility in the middle of the night. It was a temp traffic light in road works, that sank away in the mud. So basically everyone from one direction ignored the red light while seeing almost nothing. We had just avoided an accident ourselves, then witnessed another one seconds later. So we called 112. Ten minutes later, in the storm, in the night, they came and started regulating traffic until they found the guy (hours later) that could fix the light. I hear horrible police stories from the USA, but at least in western europe the police has by default my respect.

tetrep 10y ago

While I don't think scaremongering is needed, I agree that it was a bad idea to just take the skimmer. It does interfere with legitmate police operations and could delay or prevent prosecution of the perpetrators.

tokensimian 10y ago

This assumes the police have competency, concern, and resources.

patcheudor 10y ago
So it's okay to: a) not report a crime & b) take evidence from the scene of the crime because the police likely don't care, are incompetent, and have no resources?
- cle 10y ago
  What probably would have happened if the police were involved? This device would have been sealed in an evidence vault while the police investigate, and hardly anybody would ever know about it, whether these particular criminals were found or not. Instead, it's on the front page of Hacker News, and a LOT more people are aware of how sophisticated skimmers have become, and will be a lot more careful to check for skimmers on ATMs, and probably start warning family members and friends. IMO, this had a much more positive impact overall than anything the police would have done. But perhaps my opinion of police does not apply to Austrian police...
  - patcheudor 10y ago
    While waiting for the police there's nothing wrong with making a video. Taking it home to inspect it? That's something else entirely. In terms of this as valuable education, lets put our critical thinking hats on. Did this ultimately make the world safer and help real people? Likely very little because most people have zero liability for credit-card fraud and if we think through this a bit more maybe it makes the world more dangerous. What happens when someone who watched this video decides to do the same when they find a skimmer in Mexico, but someone from the local crime syndicate that placed it there see's them remove it, then follows them until they have a chance to take it back with force? Now someone gets hurt. In all cases, immediately call the police. EDIT: and if you don't trust the police, leave it, walk away, and anon call it in or call the bank.
    - cplease 10y ago
      I would agree it is completely stupid to remove and walk off with an ATM skimmer in a foreign country, all before calling the cops. There are so many ways that could end badly. There's nothing informative or educational that couldn't be shown by pictures or videos at the ATM and calling cops right away (the poster is now claiming he did call cops when he was able to get to a phone; this is still not impressive). However, this is an ATM skimmer + PIN cam. Not credit card fraud. Debit and ATM cards have much less protection. Consumers have 0 liability for CC fraud; when but your card is skimmed and PIN is stolen your checking account can get emptied, and you potentially have the burden of proving that it wasn't you using your card in a card-present, PIN transaction.

jliptzin 10y ago

In practice though I think it's actually better to warn the public about this so they're aware and can check for themselves. Every single time I contacted the authorities in my entire life (in one instance a pretty significant crime) it turned out to be a huge waste of my time.

passivepinetree 10y ago
Could you give an example or two and some specific reasons why? I don't doubt you at all; I'm just interested.
- seanp2k2 10y ago
  I've had similar experiences. In one example, an uninsured driver backed up into my car as we were leaving a gas station. The driver was obviously intoxicated (seemed like high on marijuana, the smell was quite strong). I asked for their insurance, they said they had none, and said "please don't call the police". They then got back in and drove away. At this point, the station attendant comes out and says that he has video cameras and the tape and that he saw what happened and would do whatever he could to help. I called the police and all they cared about was "was anyone injured? No? Then we're not coming out. You can come here and file a police report if you want." They honestly didn't care about a hit-and-run with an uninsured driver who very likely had drugs on them. I filed a police report and got the damage looked at, and it was less than my deductible to repair, so I just ate it. Nothing ever happened with the police report. It also annoys me that this happened in my home town where the police absolutely love to sit at freeway exits where the service drive lane has a stop sign instead of a yield sign and write tickets all day for people rolling the stop signs, so I very much doubt that they have anything better to do, they just seem super lazy.
- jliptzin 10y ago
  In one instance I was driving on the freeway in some traffic in the right lane and suddenly a huge 18 wheeler truck behind me starts honking the horn, I had no idea why. I creep up as much as I could as there was another car in front of me. The truck driver proceeds to rear end me. The first time I thought it was an accident, then he keeps doing it over and over again until I am finally in the shoulder. When I'm out of his way he starts driving away, I follow him to get his tag # and call the police. He did some pretty significant damage to my car. When they arrive to file the report they tell me there's 'nothing they can do' because the plates were out of state. They said they would file the report anyway. About a year later I shop around for car insurance and discover that the police report somehow indicated that the collision was my fault. Luckily the insurance company took a look at the damage and saw I was rear ended and concluded it probably was not my fault and removed it from my record.

forrestbrazeal 10y ago

If you load the comments on the article, the original author claims that he did in fact contact the Vienna Police Department. Whether he should have touched the skimmer at all is another question.

deleted 10y ago
[deleted]
snsr 10y ago
How would one determine that the device was, in fact, a skimmer without touching it?
- Zuider 10y ago
  A quick visual inspection would reveal that the false card bubble with the skimmer installed was different in two significant ways. It was glued into place, while a real one would be embedded into the panel, and it was larger than the real one which was visible on the ATM to the left.
collyw 10y ago
It seems irresponsible not to remove it.

valine 10y ago

Perhaps I'm wrong about this, but I can't really imagine the police are well equipped to handle this sort of thing. I guess don't have much faith in the authorities when it comes to cyber crime. The police can only do so much. Giving people knowledge to protect themselves is far more beneficial imho.

cisstrd 10y ago
Watch a Crime Series like Forensic Files (even if the cases might be cherry-picked) and your attitude might change. Sure regarding technology they are not always up to industry standards, they might have to deal with too much workload, they might be under-funded, and someone working for the police will most likely not be smart enough to work for Google and earn 200000$ a year. But they can take fingerprints, they do have databases where they collect such information, they certainly can analyse video material, and it's stupid to think that in a country like Austria this won't be investigated (it's also Vienna we are talking about). Even if they just take some fingerprints, analyse the video material, maybe notify the bank and send out a memo, how is this not worth reporting it immediately?! The bank being notified can warn customers, change pins for customers they think might be victims, are paying more attention, ... I won't name other countries as I don't want to insult anyone, so let's just say in a "tourist-heavy corruption-ridden non-1st world country" I could sympathize a little bit more with your sentiment, but in this case I think you are just wrong and should re-think your attitude.
- rjbwork 10y ago
  > But they can take fingerprints We've had a rash of car break-ins in my neighborhood. My roomate had a large metal ball hucked through his car window, and when the police called, the dude refused to bag it for evidence, take it with him, fingerprint it, or anything. I'd say to consider yourself lucky if your local beat police give a damn about collecting evidence of a crime that's not drugs, violence, or human trafficking. EDIT: Just remembered, instead, he picked up the metal ball and started tossing it around, from hand to hand, into the air, etc. All casual like - as if it were a toy. Callous disregard for his job and totally destroyed the evidence.

syngrog66 10y ago

In a world of only-smart-people: yes, I agree. In a world of mostly-dumb-people: no, I disagree. The overwhelming majority of my direct life experience, so far, to date, says we are awash in a world of dumb people. Therefore, I can't say I agree with you. "Report a vulnerability? They'll assume you are an evil attacker. Glance at a pretty girl? They'll assume you're an evil pedophile. Wear camo pattern pants? They'll assume you're an evil militant revolutionary gun nut freak mass murderer waiting-to-happen." Takeaway: The world in reality is very different than the world as it exists in your theory or ideal.

snowwrestler 10y ago
This is just self-serving rationalization for never doing anything. If you find a skimmer, call the cops. Even a dumb cop is not going to think you called them to remove and investigate your own skimmer.
- syngrog66 10y ago
  never never NEVER underestimate the power/prevalance of dumb people in SF/Paris/London? sure, different in Kansas/rural/etc? see the first rule
- syngrog66 10y ago
  > Even a dumb cop is not going to think you called them to remove and investigate your own skimmer. you might be so smart that you don't know what "dumb" means. I assure you: speaking after enough decades on this planet, that "dumb" means something which includes, at a minimum, totally lacking or ignorant in what a "smart" person might include as "common sense". speaking in broad strokes. any kind of phrase of "even a dumb person surely wouldn't do X, Y, Z" should be assumed false/wrong. otherwise "dumb" means nothing. again, speaking in broadstrokes, obviously. (again: for "smart" folks it should be obvious but to "dumb" folks may not be obvious. HN readership, however imperfect they may be, is overwhelmingly weighted towards the "smart" end.)
- syngrog66 10y ago
  It is a world based on direct evidence. Not on theory or wishful thinking.

peletiah 10y ago

The Viennese police have sent out a warning on twitter and a press release shortly after this went public: https://twitter.com/LPDWien/status/745907477833719808 https://twitter.com/LPDWien/status/745907477833719808

hyperman1 10y ago

As there is a lot of distrust against the police in this thread, I'd like to share my experience with them in my home country, Belgium. In every case, they were professional, as human as possible, and did more than required form them in bad situations: * Suicide attempt by close relative: Police called us in the middle of the night after making sure immediate medical aid was given. They let us stay in the police night office until we could enter the hospital in the morning, gave us coffe, calmed us as much as possible. At that point the suicide attempt vs murder attempt part wasnt very clear and they could have treated us as potential murderers. * Unexpected death of another close relative in Holland: Both Belgian and Dutch police gave every help they could, even calling back the 2 cops from a day of who had found him in very messy circumstances (which explains the day off). Lots of legal wrangling because he died in another country, but they did everything they could and more. * Failure of a traffic light in heavy storm with zero visibility in the middle of the night. It was a temp traffic light in road works, that sank away in the mud. So basically everyone from one direction ignored the red light while seeing almost nothing. We had just avoided an accident ourselves, then witnessed another one seconds later. So we called 112. Ten minutes later, in the storm, in the night, they came and started regulating traffic until they found the guy (hours later) that could fix the light. I hear horrible police stories from the USA, but at least in western europe the police has by default my respect.