Pre-Attack Indicators on Camera: What Casing Looks Like Before the Break-In

You bought the cameras. You hung them. You pointed them at the front door and the driveway, paid the cloud subscription, and now your phone buzzes a dozen times a day with motion alerts. You swipe them away because most of them are the wind, the cat, the Amazon driver, or your neighbor walking past. Somewhere in that pile of dismissed notifications is the footage that would have told you a break-in was coming three days before it happened. You just never watched it.

That is the gap this post closes. Cameras are not magic. They are a sensor array attached to a recording device, and their entire defensive value depends on a human being who knows what to look for. The bad guys do reconnaissance. They walk past, drive past, knock, probe, and scope long before they kick a door. The footage exists. The pattern recognition is what's missing.

Why Most Home Cameras Are Decorative

Walk any suburban block in America and count the doorbell cameras. You'll lose track. Now ask the homeowners how many hours of footage they reviewed last week. The honest answer for most is zero. They installed the camera, watched the first day of clips, got bored, and now the system functions as a deterrent sticker with a livestream they ignore.

That works against the casual smash-and-grab. The UNC Charlotte burglar study surveyed 422 incarcerated burglars and found that roughly 83% try to determine if an alarm or surveillance is present before breaking in, and about 60% will pick a different target when they see one (Inside UNC Charlotte, Through the Eyes of a Burglar). Visible cameras and yard signs absolutely move some attackers down the block. We've covered that in detail in why alarm yard signs deter burglars.

But the burglar who is willing to push past your signage, the prowler doing a knock-and-talk to confirm occupancy, the crew scoping packages mid-day — those people don't get scared off by a doorbell camera. They get recorded by it. And whether that recording becomes intelligence or becomes a deleted thumbnail is up to you.

The fix is doctrine, not gear. Two is one, one is none applies to information too: a camera that nobody reviews is the same as no camera. We're going to fix that.

The Reconnaissance Phase: What Casing Actually Looks Like

Greg Ellifritz, who writes the long-running tactical blog Active Response Training, has compiled the practical research on how burglars select targets. In his summary of the offender-perspective study, he notes that the typical burglar averages roughly 12.9 prior arrests and that about half work in pairs (Understanding Decisions to Burglarize from the Offender's Perspective). These are experienced criminals. They have a routine. The routine is observable.

John Correia at Active Self Protection has reviewed thousands of caught-on-camera defensive encounters and breaks the pre-attack process down to a single discipline: establish the baseline, then notice the anomaly. On your own street the baseline is the mail carrier at 2 PM, the school bus at 3:15, the same five neighbors walking the same three dogs. Anomalies are what your camera footage is for.

The Slow Drive-By

The classic. A vehicle rolls past your house at a pace noticeably slower than the speed of traffic, sometimes pausing at the curb. Ellifritz and other instructors note that casing drive-bys frequently happen one to three times in the 24-72 hours before a break-in. On camera you'll see the same plate, sometimes a different driver, sometimes with the rear seat occupied. The vehicle often has paper plates, a covered plate, or expired tags. The driver is looking at the house, not at the road.

The Knock-and-Talk

This is the most-used residential reconnaissance technique in America, full stop. A subject walks up, knocks or rings, and waits. If you answer, they're "looking for Sarah" or "lost," and they apologize and leave. If you don't answer, they probe further — check the side gate, look in a window, walk around. The knock is a binary occupancy test. It is not a conversation; it is a sensor.

Tells on camera:

• No clipboard, no uniform, no logo on the vehicle, no anything that explains why they're there
• They knock, then immediately step off the porch and look up at the camera or down the side of the house
• They linger after the knock for an unusual amount of time, then walk the property line on the way out
• Two subjects: one knocks, one stays at the curb watching the street

The Package Theft / Delivery Pretext

Mid-day visit, often by a single subject on foot or out of an unmarked vehicle. They walk up to the porch, look at any packages, look at the door hardware, and look up at the camera. Sometimes they pretend to check a phone for an address. They don't actually take anything on this pass — this is scoping. The grab happens on a later visit, often by a different person.

The "Is Anyone Home" Probe

This is the casing behavior most homeowners never see because it happens on the side and back of the house, where they've never pointed a camera. Subject jiggles a side gate, rattles a fence, taps on a back window, sets off a motion light to see whether anyone reacts. We covered the active layer of this in motion sensors as early warning and the audible layer in door chimes and the OODA loop. The visual layer — a camera covering the side yard — is often missing entirely.

The Maintenance / Utility Pretext

Fake utility worker, fake landscaping bid, fake meter reader, fake "tree assessment for the city." This is high on the FBI and local police bulletin lists year after year because it works on older homeowners and on anyone who hasn't been told what real utility crews look like. The real ones have marked vehicles, ID badges they'll show you without being asked, and a work order they can reference. The pretext version has none of that, deflects when questioned, and spends more time looking at your doors and windows than at any meter, panel, or tree.

Pre-Attack Indicators on Camera Footage

Here is the pattern library. When you sit down to scan your week of footage, this is what you are looking for. Most of these will appear as harmless one-offs. Two or three of them clustered on the same subject, the same vehicle, or the same 72-hour window is the signal.

• The camera glance. Subject looks directly at your camera before approaching the door. Civilians don't notice cameras. People who are deciding whether to commit a crime do.
• Property-line movement. Subject walks the perimeter of the lot, not the walkway. Visitors take the path. Casers take the line.
• Repeat visits, no escalation. Same subject knocks twice in three days, never leaves a flyer, never has anything to deliver. The visit itself is the product.
• Body angle off. Subject stands at the door but is angled toward the windows, the side yard, or the garage rather than the door they just knocked on.
• Hands hidden in warm weather. Hands in jacket pockets, hoodie pulled forward, gloves in July. This is concealment, plain and simple.
• The parked watcher. Vehicle parked one or two houses down with someone visible in the driver's seat for an extended stretch. Often paired with the knock-and-talk subject on foot.
• Walking the dog without a dog. Or with a dog that is clearly not used to being walked — nervous, untrained, on the wrong kind of leash. The dog is camouflage.
• Pace mismatch. Pedestrian moves slowly past your house and at normal walking speed past the neighbors. They're cataloguing your house, not exercising.
• Flashlight at odd hours. A subject using a phone flashlight or handheld light along your fence line at 2 AM is not a lost neighbor. They are looking for entry.
• The package non-delivery. Subject in delivery-adjacent clothing approaches the porch, handles nothing, leaves nothing, and departs.

Treat these as PIDs — pre-attack indicators — not as proof. The point is to build a picture, not to confront a stranger over a single odd notification.

How AI Cameras Surface These Patterns

The reason to spec a modern AI-equipped, NDAA-compliant system over a generic motion-only camera is that the AI can pre-filter the swiping problem. Instead of 200 motion alerts a day from leaves and headlights, you get a handful of person- and vehicle-tagged events with snapshots you can scan in three seconds.

The features worth paying for:

• Person and vehicle classification. Reolink's ReoNeura AI and Lorex's smart detection suite both filter out the false positives. Animal, vehicle, person, package — each gets its own tag.
• Loitering detection. Subject in frame longer than a configurable threshold (often 30 seconds) without crossing a defined line. This is your knock-and-talk and your parked watcher.
• Line-cross / area-intrusion. Draw a virtual line at the property edge or a virtual box around the side gate. Anyone breaking the line at night triggers a high-priority alert separate from porch traffic.
• Familiar / unfamiliar face flagging. Some systems will mark a face as "seen before," letting you spot the same subject across multiple days even if you don't recognize them.
• Vehicle plate recognition. Higher-end NVR systems with 4K bullets at the driveway will pull plates clean enough for a non-emergency report. Worth every dollar in suburban neighborhoods.
• Rich push notifications. Snapshot plus timestamp on the lock screen, so you can triage in three seconds without opening the app.

For an audience that cares about data sovereignty, NDAA-compliant gear matters. We break down the spec criteria in our home security systems comparison and walk through the remote-control side in controlling your system remotely.

The "Review Your Footage" Doctrine

This is the most-overlooked OPSEC habit in residential security, and it costs nothing. Block fifteen minutes on Sunday morning. Coffee, phone, app. Scan the past week's tagged events — not every single motion clip, just the person and vehicle tags. You're looking for clusters:

• Same vehicle past your house more than twice this week at unusual hours
• Same face on the porch with no associated delivery or appointment
• Anyone touching the gate, fence, or side yard after dark
• Any pedestrian who pauses in front of your house
• Any approach that breaks the pattern of your normal week

This is your offline OODA loop. You don't have time to observe-orient-decide-act in real time during an actual break-in — the average residential burglary is under ten minutes and the bad guys know it. What you can do is observe and orient in retrospect so that when something starts going sideways live, you've already decided. You already know that gold sedan. You already know that knocker. Your decision time collapses to seconds because the orient step is done.

This is the same principle the Tactical Professor and Massad Ayoob have hammered for years on the personal-defense side: pre-loaded decisions are faster than fresh ones. Scanning footage on Sunday is the home-defense version.

What to Do When You Spot a Pattern

Don't confront. Don't post the clip on Nextdoor and demand the neighborhood find them. Document and harden. In order:

• Save the clip locally. Pull it off the cloud and onto your NVR or your phone. Cloud is convenient and also rentable, deletable, and outside your control. Two is one, one is none applies to evidence.
• Capture identifiers. Timestamp, plate (zoom in on the driveway camera), vehicle make and color, clothing, height relative to your door frame, any visible tattoos.
• Call the non-emergency line. Suspicious activity reports cost you nothing and they get logged. If three neighbors report the same vehicle in the same week, that's a patrol assignment. We covered what dispatch and patrol actually do with these reports in how police respond to home security alarms.
• Notify your block. Text the neighbors directly — not Nextdoor, not Citizen, not Ring Neighbors. A direct text with a still image and a timestamp is force multiplication. They check their cameras for the same vehicle and the picture sharpens.
• Increase posture. Arm the system at all times for the next two weeks. Move valuables out of the master bedroom. Light up the perimeter; we covered the area-denial side in tactical exterior lighting.
• Harden the entry points. Reinforced strike plates, longer screws, secondary locks on sliders. Most casers want a soft target; turn yours into a fatal funnel for them, not for you.
• Know the 911 trigger. Suspicious vehicle parked across the street is non-emergency. Subject jumping your fence, prying a window, or trying door handles in real time is 911. The line is in-progress versus reconnaissance.

Camera Placement That Catches Casing

The number-one mistake homeowners make is pointing every camera at the front door. The front door is where the legitimate visitors come. The casing happens on the perimeter and the soft sides. Casing burglars don't walk up to your front door — they avoid it. Cover the path the threat actually uses:

• Driveway and street-facing. Wide-angle 4K bullet covering the curb and the first thirty feet of street. This is your slow-drive-by camera and your plate-capture camera.
• Yard perimeter and side gates. Where the "is anyone home" probe happens. A turret at the corner of the house covering the gate and the side yard is more valuable than a third porch camera.
• Approach paths. The walkway, the side of the house, the rear corner. Anyone walking these is on your property without a reason.
• Garage and man door. Often the actual entry point in a real break-in. Most homeowners have zero coverage here. We treat the garage as its own attack surface in our breakdown of layered defense at echelons of defense.
• Dead space audit. Walk the property at night with a flashlight. Anywhere the flashlight beam doesn't get caught by a camera is somewhere a caser will linger. Eliminate it. 360° coverage with no ground-level blind spots.

NDAA-compliant brands worth speccing: Reolink, Amcrest, Lorex on their newer X-series, and the better commercial Hikvision-alternative lines that explicitly meet Section 889. Avoid anything that routes mandatory video through a Chinese cloud regardless of price.

The Neighborhood Force Multiplier

One camera tells you what happened on your driveway. Five cameras across five houses tell you what happened on your block. The same vehicle showing up on three driveways across two days is not a coincidence; it is a casing pattern, and police can act on it in a way they cannot act on a single clip.

Build the network manually. Text thread with your nearest five or six neighbors. When one of them flags a vehicle or a knocker, everyone else does a footage check. This is the pre-internet version of what Ring Neighbors and Citizen are trying to do, and it has none of the data-sharing problems for an audience that cares about OPSEC. The cloud platforms are useful as a backup; the direct text thread is the primary.

For more on staying invisible to data brokers and casual recon, see our writeup on OPSEC for homeowners and the gray man doctrine. For protecting the soft entry points the cameras can only watch, see door and window hardening and the garage as a soft flank.

Spec and Review Checklist

What right looks like for a casing-aware camera setup:

• Coverage: Front door, driveway with plate-readable angle, both side yards, rear yard, garage interior and exterior man door. No ground-level dead space.
• Resolution: 4K on the driveway and any plate-capture angle. 2K minimum elsewhere.
• AI detection: Person, vehicle, package, animal classification. Loitering and line-cross zones drawn at gates and the property edge.
• Storage: Local NVR with 30 days minimum recording. Cloud as redundancy only, not as the primary.
• NDAA compliance: Section 889 verified. No mandatory foreign cloud routing.
• Notification hygiene: Person and vehicle alerts only on the lock screen. All-motion alerts off, or routed to a separate quiet channel.
• Review cadence: Fifteen minutes weekly to scan tagged events for clusters. Calendar it like an oil change.
• Response checklist: Documented steps for what you do when you spot a pattern, taped to the inside of a cabinet door so you don't have to think under stress.

Bottom Line

Cameras don't stop break-ins. People who watch their cameras stop break-ins. The reconnaissance phase is the longest, slowest, most observable part of the entire attack chain, and your gear is already recording it. The only question is whether you sit down on Sunday morning and look.

If you want help speccing a system built around AI person-detection, local NVR recording, full-perimeter coverage, and NDAA-compliant gear — rather than another doorbell-only installation that misses everything happening on the side of the house — that's exactly what we do. Start a free assessment at Smart Security Concierge and we'll walk the property with you, virtual or in-person, and lay out a system that catches casing before it becomes a kicked door.