___ _ _
| |_)|_). The Propaganda Press
| | | . Basic Phreaking from Pay Phones
Written by: THE PYRO (507)
Date Written: August, 1987
-*-
(P-C) Pseudo-Copyright 1987 by The Propaganda
Press, International. Failure not to distribute
this information is punishable under the Pseudo-
United States Code (P-USC). You have been warned.
-*-
INTRODUCTION: So, you want to phreak from a pay phone, but you are in a bad
situation. You need to make a call, yet you do not have an 800 extender or
or 950 extender. And of course you have no quarter (or are too cheap to
spend one). And to top it all off you don't have any sort of "box" or tone
generator. So, what will you do? Well, by reading this file on basic ways
to manipulate (aka: social engineering) various parts of the phone network
you will be able to make that call. This file is broken down in to a few
parts. They are:
I. Charging the call to a OCC (Such as MCI, Sprint, etc.).
A. Charge and then use a PIN.
B. Third party charge (no PIN needed).
II. Charging the call to a BBS.
A. Call and Connect to BBS.
B. Third party charge.
PART I: In order to accomplish this method you must first have the dial-up
extender number for an OCC (Other Common Carrier). Any OCC will do. I have
found that MCI works well (but that is more preference than anything else).
A. In this method you will be charging a call to the OCC. When the
operator part of the call is complete then you will dial in the PIN
you have, plus the other numbers in that particular OCC format to
place the call. For demonstration I will use the local MCI at my
disposal.
1. First, call up the OCC from the pay phone as if you were going
to make a collect call (0+pre+suff).
2. When the operator answers tell them that you would like to charge
the call to the number dialed. When they ask who is calling
give them any name. It would help if you refrained from using
your last name for obvious reasons.
3. Now it can get a bit tricky. In order to accomplish this next
part you must change your voice to sound like someone else. And,
it must be convincing. When the OCC answer with that drab yet
perky tone quickly press the first # in the format needed to make
a call through that OCC. Once this is pressed the tone should
stop. Some OCCs allow you to press a # or * without it being
part of the PIN, some do not.
4. Now, doing the best acting job you can politely answer (in your
different voice) "HELLO?" In case you are lost, you are
impersonating the person you have supposedly called.
5. If your acting job is good the operator will ask you "WILL YOU
ACCEPT A COLLECT CALL FROM [your name]?"
6. In your acting voice simply answer "YES"
7. The operator will hang up. You should hear a click as he or she
hangs up. Once the operator is gone continue with the rest of the
numbers needed to finish the sequence.
HINTS/NOTES: This method must be done quick. If you delay too long
then you might time out on the OCC and have to start
over again.
B. In this method you do not have a PIN for the OCC you are charging to.
Thus, you will do a third party billing to accomplish your mission.
Again, I will demonstrate on my local MCI system.
1. Dial the number you wish to call in the collect call format
(0+NPA+PRE+SUFF).
2. When the operator cuts in tell him/her that you wish to bill this
call to another number. They will ask the number. Give them the
OCC extender you are going to use. As in the above process, when
they ask for your name give them any old name.
3. Once again you must slip in to your alternate personality in order
to fool the stupid operator. When the operator calls the OCC number
to verify your charging it to them answer by pressing any number to
shut off the tone. The simply say in your acting voice "HELLO?"
4. The operator will ask you if you will accept a third party billing
from the real you. You simply answer "YES"
5. Since your charging the call is approved the operator will now
connect you to the number you really wish to call and thank you
in a very friendly tone for using their service. They are so
nice and helpful.
HINTS/NOTES: In this form speed is not a critical issue. But remember
to stay calm.
PART II: In order to pull this form off you must be a VERY good actor and
sometimes a bit lucky. You will need the number of a BBS or any line that
produces a carrier tone. It would not be nice to charge to one of your
favorite boards. I recommend the local 13 year old supEr ElitE piratE board.
These boards usually work great.
A. In this method you are going to charge and connect to the BBS. This
works well for hacking a system, or logging on to a board you really
do not care for. But, you must have a portable or a laptop to
accomplish this method. You must also have good knowledge of your
little system so that you can connect before the carrier tone drops.
1. Call the BBS as if you were charging the call (0+NPA+PRE+SUFF).
2. Tell the cheerful operator that you wish to charge the call to the
number dialed. And once again, give the operator any old name.
3. When the BBS answer the phone use you by-now-perfected actor voice
to answer something like "HELLO? DAMN MODEM, I CAN'T SHUT IT OFF"
talk loud, otherwise the operator might not here you over the tone.
4. When asked if you will accept charges yell "YES!"
5. When the operator clicks off have you laptop modem pick up and
bingo. Instant connect.
HINTS/NOTES: This form can be trouble sometimes. It is also not very
practical. But hey, it works.
B. This method is much like PART I, SECTION B. The only difference is that
the third party billed to is a BBS, not an OCC. Simply follow those
instructions plus ITEM 3, from PART II, SECTION A and you will have
no problems.
HINTS/NOTES: Just like SECTION A of this part it can be trouble
sometimes. And that damn carrier tone has been known to
induce headaches at times.
CONCLUSION: Well, I know that this covers the bare basics of pay phone
phreaking. Like I said before, it is used when you have absolutely no
resources or are too cheap to use them. There are, however, a few more notes
that you should be aware of. They are:
1. Occasionally you will get an operator who knows what you are trying
to do. I suggest you hang up and find another phone to try it
from. I personally have had the operator send a AT&T Truck out to
investigate.
2. Some OCC numbers will be listed as numbers that cannot accept
collect calls. This usually happens because you have, or someone
else has, charged a call or calls to it before. In my experience
they have only flagged the roll-over line. That is, the main line
you call. Set up a scanner to search out the actual lines you are
rolled over to. I personally have a list of 50 lines that my local
MCI uses. When one gets flagged for charged calls, switch to
another.
3. I have used these methods to charge Alliance Teleconferences
before, as well as go overseas.
4. Like I have said many times, these are basic ways to accomplish
your mission. I am currently working on "Advanced Ways to
Accomplish Other More Interesting Missions" All of this "mission"
talk makes it seem like you are actually the conspirator trying to
ruin the US like the secret service tries to make us look. Heh.
Please excuse all typos and spelling errors. And remember, let's be careful
out there....
