Petty Scams and Telephone Tricks
Mostly by RBCP
Written On April 8, 1990
Last Revision on January 09, 1995
For Informational Purposes Only. We're Not Responsible For Your Stupidity
If you've ever come across a telephone (whether it be rotary or touch tone) and for some reason there's a lock on the phone or the dialing keypad has been disconnected, don't dispair. You can still make a call using the prehistoric pulse dialing technology.
Let's say you want to dial the number "123-4567" so you pick up the phone and get your dial tone. Now quickly press and release the hang up button once. That should dial your number "1." Now repidly press and release the hang up button twice and you've dialed your "2" and so on. If you want to dial a zero, rapidly press and release the hangup button ten times. I actually got a disciplinary write up at work for teaching my co-workers how to do this after the manager disabled outgoing calls.
Sometimes if the owner of the phone has a lot of custom calling services like call waiting and three-way calling, this method of dialing might not work because it messes up the timing of the clicks and you always get a wrong number when trying it. Usually it will but I've come aceoss phone that won't dial that way. It also could depend on the type of phone being used. Another way to get by a locked dial is to buy a touch tone dialer from Radio Shack.
A lot of businesses out there have what's called a network phone system. This means they have a minerature phone company in the office which let's them restrict all kinds of things such as if one of their phone will be allowed to make outgoing calls. To avoid having employees chatting on the phone all day or a customer picking up the phone and dialing long distance, they usually restrict outgoing calls on a lot of the phones in the network.
Sometimes you can pick up the phone and hit "Line 1" or "Line 2" or whatever and get a dial tone, you just won't be able to push any of the buttons on the phone to dial out. If you try, you eiher get a busy signal or nothing. The solution to this is to buy a pocket tone dialer from Radio Shack (The $15.oo model is fine) and dial the number with that. That way, you're not pressing the network's buttons so it doesn't know anything's going on and you get your phone call, whether it be across the street or in Austraila.
If you pick up the phone and can't even get a dial tone, then you have to wait for someone to call you. When the phone rings, pick it up, answer their questions and get rid of them as quick as you can. When they hang up, stay on the line. In about a minute the phone company's equipment will reset and you should get a dial tone. From there just use your pocket tone dialer to dial out.
In airports you'll find a big console with all the local hotels listed on it. To reach one of the hotels you press the button next to the hotel you want to speak with. Usually, this setup is nothing more than a speed dialing phone with all of the hotels programmed into the memory buttons. Use your Radio Shack Pocket Tone Dialer to dial anywhere in the world on these phones. Same goes for the rent-a-car booth.
If you scan numbers where the first two numbers of the suffix is 00 or 99, you'll find a lot of phone company related numbers like loop lines, weird recordings, sweep tones, etc. If you're looking for this type of thing it's best to find out what the phone company's local office prefix is and use that. Like if the phone company's billing office number is 556-4200 call up every number from 556-9900 to 556-9999 or 556-0000 to 556-0099. A real handy recording to find is the one that says, "Please deposit 25 cents." You can drive an operator bugshit with this number.
Below is a chart that I made for hand scanning. You can do a whole 100 number exchange while you watch the Fresh Prince of Belle Aire. The chart is fairly easy to use. Let's say you want to dial every number from 618-254-9900 to 618-254-9999. Fill in the Area Code box as "618", the Prefix box as "254", the xx box as "99" and fill in today's date.
| Area Code | Prefix | xx | Date | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| xxx0 | xxx1 | xxx2 | xxx3 | xxx4 | xxx5 | xxx6 | xxx7 | xxx8 | xxx9 | ||
| xx0x | xx00 | xx01 | xx02 | xx03 | xx04 | xx05 | xx06 | xx07 | xx08 | xx09 | |
| xx1x | xx10 | xx11 | xx12 | xx13 | xx14 | xx15 | xx16 | xx17 | xx18 | xx19 | |
| xx2x | xx20 | xx21 | xx22 | xx23 | xx24 | xx25 | xx26 | xx27 | xx28 | xx29 | |
| xx3x | xx30 | xx31 | xx32 | xx33 | xx34 | xx35 | xx36 | xx37 | xx38 | xx39 | |
| xx4x | xx40 | xx41 | xx42 | xx43 | xx44 | xx45 | xx46 | xx47 | xx48 | xx49 | |
| xx5x | xx50 | xx51 | xx52 | xx53 | xx54 | xx55 | xx56 | xx57 | xx58 | xx59 | |
| xx6x | xx60 | xx61 | xx62 | xx63 | xx64 | xx65 | xx66 | xx67 | xx68 | xx69 | |
| xx7x | xx70 | xx71 | xx72 | xx73 | xx74 | xx75 | xx76 | xx77 | xx78 | xx79 | |
| xx8x | xx80 | xx81 | xx82 | xx83 | xx84 | xx85 | xx86 | xx87 | xx88 | xx89 | |
| xx9x | xx90 | xx91 | xx92 | xx93 | xx94 | xx95 | xx96 | xx97 | xx98 | xx99 | |
I have friends that have used these programs and the only thing that happens is the phone company sends them a nasty letter telling them to knock it off or else or they might get a call from the phone company. I'm always reading, though, in publications like Phrack about people actually getting BUSTED for exchange scanning. I don't know why, maybe it's considered harrassment to call someone and hang up, let alone call 1000 people and hang up. Just be warned. If you are going to use a computer, use the random scan and not sequencial.
The long distance carrier for these phones is most likely someone you've never ever heard of that charges about three times as much as AT&T or Sprint would, and that's pretty bad. If you use your calling card on one of these phones, you'll notice when you get your bill what I'm talking about. A local call from one of these phone usually even charges you more than 25 cents.
A good thing about private pay phones is that the phone line it's using isn't actually classified as a pay phone line, it's classified as a business line for a regular business customer which is why red boxing won't work. Pick up one of these phones and dial "zero." If you can get one of their operators, ask them to connect you with AT&T. Now AT&T probably won't even know that you're calling from a pay phone line. She'll probably assume you're either calling from home or your place of business.
When AT&T answers, throw them a line like, "Yeah, I'm having trouble with my phone here. There's something wrong with the buttons and I can't get it to dial right. (Crying is optional) Could you try dialing the number for me?" and AT&T will be more than happy to help you dial that number. This works for local and long distance calls. Unfortunately, an operator can't dial a 0-700 or 900 number for you.
When dealing with some of the larger privately owned chains, the AT&T operator can tell that you're calling from a pay phone so a long distance call wont work.
Since these pay phones use a regular line you can plug your own phone to their line and dial any number you want, bypassing the pay phone itself entirely. The phone wires are usually installed very amateurly so you shouldn't have much trouble locating them.
When you find the phone wires, strip the outer covering, then strip the red and green wires, clip your phone to those two wires and start dialing random numbers in New Zealand. Don't actually cut the wires to the phone in half or the owner will be upset and hide the wires so you won't be able to do this anymore. Just strip them where no one will notice so you can come back and hook your phone up anytime you want. (This is called Beige Boxing, by the way.)
To make yourself look less suspicious, you can hook up your phone, quickly dial the number you're calling and then pick up the pay phone and unhook your own phone. To the casual observer, you're just talking on a pay phone like any normal person, not screwing the owner out of hundreds of dollars. If he doesn't have a block on the phone you can dial 0-700 Alliance and 900 numbers this way. And if he does have a block on the phone, call up the phone company's billing office and remove the block, pretending to be him.
Why do COCOT's exist? Simple. Money! A customer owned payphone is money in the bank. You pay more for local calls and long distance is typically handled by sleazy carriers that offer bad/expensive service. The owner/renter of the COCOT opens the coinbox and keeps the money him/herself. Also, a particularly sleazy quality of COCOT is the fact that it does not receive incoming calls. This, of course, is because of money. If people are calling in to a COCOT, the COCOT is not making money and businesses always want to make as much money as possible even if it hurts the consumer. Think about it. It really sucks to call someone at home from a COCOT and then not be able to have him/her call you back to save money. "Guess I'll have to keep feeding the COCOT quarters!"
First of all, you must understand that the COCOT is a mimic. Essentially, it wants you to think that it is just a plain ol' payphone. Pick up the handset. Hear that dialtone? Hah! That dialtone is fake, synthesized by the innards of the COCOT. You are at the mercy of the COCOT. Remember a COCOT runs off of a normal customer loop so, unlike a telephone company payphone where you must deposit money to generate coin tones that are read by the central office, the security of a COCOT depends solely on the COCOT phone itself. It's as if you took your own phone and put a sign on it saying "Please put 25 cents in this jar for every call you make." COCOTs are not naive. They won't let you near the unrestricted dialtone until you fork over the cash-ola. Or so they think!
See, the Achilles' heel of the COCOT is the fact that all payphones must let you make 1-800 calls for free! It's not just a fact, it's the law. Now pick up the handset again and place a 1-800 call. Any 1-800 number will do. When they answer at the other end, just sit there. Do nothing. Ignore them. Wait for them to hang up the phone.
Here's an example. Dial 1-800-LOAN-YES. [Ring, Ring]...[click] "Hello, you wanna buy some money? Hello? HELLO?!" [CLICK] (You will now hear some static and probably a strange "waffling" noise, like chh, chh, chh, chh, chh.) [CLICK] DIALTONE!
Now what have we got here? A dialtone? Yes, you guessed it, the dialtone you now hear is the unrestricted dialtone of the COCOT's customer loop. So what? So I got an "unrestricted dialtone". Big Deal? You meathead, with an unrestriced dialtone, all you need to do is place a call via DTMF tones (the tones a touch-tone keypad generates).
Now, try dialing a number with the COCOT's keypad. Whoa, waitasec, no sound. This is a typical lame attempt at protection by the COCOT. Just whip out your Radio Shack pocket tone dialer and try calling a number, any number. Place it just as if you were calling from a home phone. Call a 1-900 sex line. Call Guam. You are free and the COCOT's customer loop is being billed.
Some COCOTs are more sophisticated at protecting themselves. Some will reset when they hear the dialtone. To get around this, make a loud hissing sound with your mouth into the mouthpiece after the 1-800 number hangs up. Get your tone dialer ready near the mouthpiece. When you hear the dialtone, quickly dial the first digit of the number you want to call. If you hiss loudly enough, you may be able to mask the sound of the dialtone and prevent the COCOT from resetting. Once you dial the first digit of the number you are calling, the dialtone will disappear (naturally). You can stop hissing like an idiot now. Finish dialing your free phone call. Also, some COCOT's actually disable the handset after the call hangs up (in other words you can't send DTMF tones through the mouthpiece). Oh well, better luck next time. However, most of the COCOT's I have run across only disable the DTMF keypad. So all you need is a pocket dialer to circumvent this!
Other things to know: Sure you can't call a COCOT, but it does have a number. To find out the COCOT's number, call one of the automated ANI services that tell you the number you're dialing from or dial a friend from the COCOT who has Caller I.D. so they can tell you the number. Now try calling the COCOT from another phone. You will hear one of two things: 1) synthesized voice: "Thank you" [DTMF tones] [CLICK] [hang up] or 2) a weird carrier.
A COCOT's number is only used by the company that built or sold the COCOT. By calling up a COCOT, a technician can monitor its functioning, etc. In case number 1, you must enter a 3 or 4 digit password and then you'll get into a voice menu driven program that'll let you do "maintenance" stuff with the COCOT. In case number 2, you are hooked to the COCOT's 300 bps modem (Yes, a modem in a payphone). Likewise, if you can figure out the communications settings, you'll be into the COCOT's maintenance routines. Personally, I haven't had much luck (or patience) with calling up and hacking COCOT maintenance functions. I just like making free phone calls from them!
When you dial a long distance call legitamately on a private COCOT, the COCOT will dial a sequence of numbers like their authorization codes, etc. So when you get the unrestricted dialtone and try to dial a number direct like 1-512-370-4680 you'll get a "your number cannot be completed as dialed" message or a busy signal. To get around this, instead dial 10288-1-512-370- 4680 and your call should go through.
If you're limited on the number of digits you can dial, just dial "0" from the unrestricted dialtone and ask the local operator for AT&T. Then ask AT&T to dial a long distance number for you. If you do it this way, you can't dial 700 and 900 numbers but if you use your Radio Shack tone dialer, it's no problem. Dial a 700 number like 10288-0-700-456-1002.
Sometimes the AT&T operator will know that you're calling from a COCOT and won't dial any free calls for you, but when she hangs up you can still use your tone dialer (or the fone's keypad) to dial long distance.
Toll free information can be reached at 1-800-555-1212 and of course, there is no charge for this call. There's also directory asisstance for 900 numbers which is 1-900-555-1212. International Information can be reached by dialing 102880 and asking for it.
You dial 1-800-COLLECT. The automated operator asks you to enter the area code and number you'd like to call collect. Then it say, "At the tone, please say your name...(Beep)" where you get about five seconds to say your name.
Now instead of saying your name though, you can say a quick message like, "This is Ron, call me at 801-234-7448" or "Honey, I'll be home in two hours" or "Help me, I'm trapped in a phone booth in a black neighborhood!" The person receiving the call simply refuses the charges after they hear your message and nobody pays for it. 1-800-COLLECT is the best one to use because they give you the most time to "say your name."
Ordering the directories is quite simple. You can either bill the cost of the phone books to your home phone or have them send you a bill for the amount. The beauty part of it all is that you can bill it to any phone number in the United States. In the past, I've billed my phone books to pay phones, restaurants that give me bad service, the White House and Ameritech Corporate Security.
The directory offices never seem to check up on the number you're billing to nor do they check to make sure that the billing phone number matches the billing address. Even if the person you'd like to bill it to has a block on their phone, you can still charge directories to their number and a single overseas phone book can go for a few hundred dollars. While I'm sure the person you're billing to can probably have the charges removed, it sure it a fun way to make someone you hate lose peace of mind.
If you're going to order a lot of phone books, your biggest problem would be where to ship your phone books. It's best to get a post office box and have them shipped there. I had phone books comming to me regularly for an entire six months at a post office box and was never questioned once about it, although I started getting letters saying I'd better pay them or else and Gloria, who worked the front desk at the post office always wanted to know why I got so many phone books all the time. (I told her I was an asisstant manager for a telemarketing firm.)
You could also have it shipped to your next door neighbor or any vacant house for you to pick up later. Occasionaly I even send one to my home and nothing ever happens except that I get a letter every few months from them wanting their money. Below is a list of numbers you can call to order directories.
Pick a number and tell them you want a directory from wherever and give them the billing number and address to be shipped to. In less than two weeks you should recieve it. One thing to remember, though, is that you ask them to deliver the books by regular U.S. mail unless you'll be somewhere to sign for U.P.S. A lot of post offices won't accept U.P.S. Enjoy your new hobby!
Usually the employee locator is the same number as the main number. To get this number, call up directory asisstance and ask them for the phone company's main number. Call the main number and if they're not the employee locator, ask them for that number. In most cases, it's given to you, no questions asked.
If you can't get the phone company's main number from directory asisstance, try calling the billing office and ask them. Below is a short list of numbers.
Bell Atlantic (West Virginia)..........(304)-954-6202
Bell Atlantic (Virginia)...............(804)-225-6300
Cincinnati Bell (Ohio).................(513)-397-5775
South Central Bell (Jackson, Miss.)....(601)-961-1327
Southwestern Bell (Little Rock, Ark.)..(501)-373-9800
U.S. West (Western U.S.)...............(800)-879-4357
Ameritech (Indianapolis, IN)...........(317)-265-2266
Southern Bell (South Carolina).........(800)-336-0014
Pacific Bell (Los Angeles, CA).........(213)-339-6622
Every now and then you'll meet a phone phreak who'd be happy to exchange calling cards with you or teach you a few new tricks. And a lot of average, honest people hang out on them but learn some method of calling for free so they can talk without going broke. These lines can be VERY addictive. Only regular long distance charges apply on most. Some of them want a credit card.
Hotel California........................(801)-234-SHIT
Underground Party Line..................(515)-945-6700
If you have a friend with Caller I.D., call the friend from the phone you want to identify and your friend can read the number to you. If you don't have any friends, call a business who has Caller I.D. and tell them that you're the phone company testing their Caller I.D. and ask them to read back your number.
Hacking Telephone Answering Machines by Doctor Pizz & Cybersperm:
----------------------------------------------------------------
It seems that lately there is very little discussion of one of the most
simple but useful and rewarding forms of electronic information gathering,
hacking the telephone answering machine. Almost everyone has one of these
wonderful devices these days, to catch important messages while they are away
from their phones, or to screen important telephone calls. Nowadays, they
typically have the added advantage of being accessible from remote telephones,
so one needs to simply call his or her answering machine, enter their secret
code, and then either retrieve new messages, or listen to anything they had
previously recorded on the incoming messages tape, or perform any of a set of
additional functions determined by which key they press on their touch tone
phone. They also typically ignore the fact that virtually anyone else can
gain access to their messages by entering the appropriate code. Hence this is
a wonderful system to gather information from anyone without their knowledge,
especially if they are technologically illiterate.
For the most part, there are two main types of "electronic password" used by
these systems. They are amazingly simple to crack, as they are typically only
2-digit or even 1-digit numbers. On some machines, the code must be entered
before the outgoing message is over, on others, it must be entered after the
outgoing message, and on more sophisticated models, it can be entered at any
time.
MODERN 2-DIGIT PASSCODE SYSTEMS:
These are the most common systems in use today, typically made by Panasonic,
AT&T, etc. In these systems, the code can be entered before during or after
the beep tone. For security reasons, we recommend BEFORE the beep tone, so
your intrusions are unnoticed... We will begin by discussing how to identify
the passcode.
Now, the question of how to hack their code. Well, this is so simple, you
don't even need a computer to do it. You can just enter all 2-digit
combinations until you get the right one (usually signalled by a series of
beeps on the other end). A relatively crude way was to enter each number in
sequence 01, 02, 03, 04,...,99. This works, but may take too long to enter
all numbers within the 20-30 second window we typically have before the beep
(The best time to play arounnd, as any tones entered after the beep will be
recorded on his incoming messages tape, and could let him know something is
up...). It is also important to stop as soon as you hit the right number, as
the additional entered numbers may be interpreted by the answering machine as
codes, and cause you to delete all their messages, or record a new greeting,
etc. That is really asking for trouble, and may cause them to try and change
their password (though it's usually only possible to choose from a range of
three consecutive numbers anyway...). Still, you need to be careful not to
let them catch on, eh?
A more sophisticated and fast way to do this is to take advantage of the fact
that such machines typically do not read two numbers at a time, and discard
them, but just look for the correct sequence, reading one at a time. In other
words, you can enter all 100 possible codes with roughly 1/2 the number of
keystrokes. Just enter as follows:
0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9,etc.
By reading in one phase we get:
0 0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 0,9 1,1 2,1 3,1 4,1 5,1 6,1 7,1 8,1 9,etc.
In the other phase we get:
0 1,0 2,0 3,0 4,0 5,0 6,0 7,0 8,0 9,1 1,2 1,3 1,4 1,5 1,6 1,7 1,8 1,etc.
So by proceeding as follows we enter the following matrix sequentially,
encompassing all possible 2 digit numbers:
0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9
1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9
2 2 3 2 4 2 5 2 6 2 7 2 8 2 9
3 3 4 3 5 3 6 3 7 3 8 3 9
4 4 5 4 6 4 7 4 8 4 9
5 5 6 5 7 5 8 5 9
6 6 7 6 8 6 9
7 7 8 7 9
8 8 9
9 0
The last zero is important, as it completes the cycle, and allows for the code
9 0, which is the only one not as yet allowed for. I must emphasize the
importance of quitting as soon as you get the correct code, and also do not
keep going after the beep, if you are on a modern 2-digit access code system.
This way, you can record the passcode for your future reference, and prevent
detection.
Now, we shall get on to the question of how to use their system, once
you've broken in. In general, it is recommended to obtain a copy of the
owners' manual for various machines, but I have summarized some of the basics
below.
PANASONIC
Here are the codes for a Panasonic Easa-phone KX-T1450. The KX-T2420 is
identical without Room Monitor function In this case, strange things happen
when you enter 5:
1 = Back Space (Rewind the OGM tape)
2 = Skip Forward (Fast forward the OGM tape)
3 = Reset (Go back to the beginning of the OGM tape. MAY CAUSE ERASURE!!!)
4 = Memory Playback (Listen to new messages)
5 = Room Monitor (!!!! Listen to what is going on in the room NOW !!!!)
(This is only available on some models... But, try it...)
7 = OGM-REC (Record a new greeting!!!)
9 = OGM-STOP (Stop recording the new greeting)
* = OGM Skip (Don't Listen to the OGM)
0 = Turn off the machine !!!!!
To set to the answer mode remotely,
1. Dial the phone number
2. Wait 15 rings and hang up
To turn off the unit remotely (!!),
1. Dial the phone number
2. Push the code number, wait for the beep, enter 0, and hang up.
Panasonic answering machines also respond to the user with a series of codes
which I will now outline. If you hear something different, you may not be on
a Panasonic system.
1 long beep : This is the "beep" after which people can leave their messages.
Also, this is sounded when the correct passcode is entered from
a remote telephone. (Same sound- Hint for software developpers)
It sounds when the tape has fully rewound, and after each
message is played back in entirety.
3 short bps : This sounds after the last message has been played back.
2 short bps : (10 seconds later) You are then being recorded - marker message
6 short bps : End of the incoming message tpe
6 short bps : (Quickly) Tape Broken (either incoming or outgoing)
Also, after entering the correct code, and after the one long beep, you will
hear n additional short beeps, where n is the number of new messages since the
last time the messages were retrieved. Remember, you can listen to earlier
ones on the same tape, by additionally backspacing from the first new message.
Anyway, that is a basic summary of the Panasonic answering machine system for
this machine. Many machines unfortunately do not have the Room monitor
function, so you can not see if you left your TV on, or anything like that...
Also, not all systems are identical, but on Panasonic machines, the numbers 1-
4 are the same, so this is the most important thing for you to remember
anyway...
AT&T
On AT&T machines, like the Answering System 1304, the passcode is again a 2-
digit number enterable before, during, or after the beep. Follow the same
guidelines as above.
After you enter the correct code on these machines, the system will
automatically begin to play back new messages. This is one key way to
distinguish these machines from the Panasonic ones discussed above.
To summarize the key functions for the AT&T system, look below:
2 Rewind tape (tape rewinds for as long as this key is depressed)
3 3 Clear messages (reset the tape to the beginning.)
5 Fast Forward (tape ffwds for as long as this key is depressed)
7 Replay messages from the beginning
8 8 Turn off the answering machine
* Record a memo (After listening to messages) OR
Skip the greeting (w/o entering code)
0 Turn on the machine (after hearing two beeps)
# Pause (for 5-7 seconds)
Basically this system is less sophisticated than the Panasonic. You cannot
change the OGM remotely (Damn!). As seen above, the codes are also quite
different, but fortunately they are easily distinguished by how they answer
after the security code is entered. The AT&T plays the messages, while the
Panasonic just beeps to tell you how many new messages are waiting. Here
also, the rewind and fast forward functions operate for the length of time you
depress the 2 and 5 keys respectively. On the Panasonic, they reewind or fast
forward for 15 seconds. Also, this system has a pause feature. By entering
the # sign, you can pause for a few seconds while listening to a message. One
extra safety (from your perspective...) feature is that on this system you
cannot erase messages until they have all played back, so you have less risk
of fucking up someone's system if it is an AT&T. You cannot change his
greeting, and it is difficult to accidentally erase his messages. If you wish
to do so, however, you must hit the 3 key twice after listening to the
messages in their entirety. To record a memo (why would you want to do
this???), you can press the * key after you hear 5 beeps (after listening to
the messages). Then begin to record. Also, the * key can be used before the
message is finished to skip listening to the OGM (useful for long distance
callers who are actually paying for the calls...) without the need for
entering a security code. To turn on the system from remote points, you need
to let it ring ten times, and after it answers with 2 "beeps", hit the 0 key.
It will subsequently be on. Similarly to turn it off, just enter 88. If the
machine answers the phone with no greeting, and just 2 beeps, it means the
tape is full. You can now enter the security code (without risk of them
recording the BEEPS!!!) and listen away for a long time!!! Basically, this
sums up the properties of the two most common systems I've encountered of the
2-digit passcode variety.
SINGLE DIGIT PASSCODE MACHINES:
On some old model Panasonic and Phone Mate systems, the secret entry passcode
is only a one digit number(!!!). On these primitive systems, one merely
enters the correct number, during the message, and playback begins. The other
codes are simple to derive, and just for the sake of making this hobby a sport,
I will not give details for these systems. It is easy enough to figure them
out, and on these systems, it is hard to screw things up, as there is little
you can do anyway.
APPLICATIONS:
This can be a rewarding adventure if you decide to follow those instructions
I will point out some of the potentially entertaining, useful, and/or
informative applications of this technology.
As the true weirdos that we are, we shall begin with what we consider the
truly entertaining applications... If you have ever read the Village
Voice, Screw or other such newspaper, you will notice a large number of
advertisements for "unlicensed massage parlors", "Oriental relaxation spas",
"Escort services", etc. Call some of those numbers, preferrably at off-duty
hours (6-9 AM??) and try to hack their answering machine codes, listen to
their messages, and let the fun begin. You can hear lots of perverts, and
lowlifes making appointments for "services" about which they are sometimes
graphic. Also, they often leave telephone and credit card numbers (What
fun!!!). In case they are married, think of the blackmail potential...
Further, these "adult entertainment companies" also often run help wanted ads
in the Village Voice, and other such publications. Call these, and you will
get a plethora of phone numbers for nubile young women who might believe you
are the proprietor of the establishment in question. You might be able to con
some "free samples" as a sort of "job interview"... (hehehe) Especially given
the illegal activity they desire to become involved in, they will be in no
position to complain when they find out you are not for real. Also, this way,
the girls are often not so jaded as the old pros. They will be trying to
impress you if you get my drift, so you'll "hire" them.
Let us move on to the informative espionnage type of application of this
technology. One could very easily use this technology to listen to the
messages of friends, and see what they are up to. If you are trying to call
your buddy Evan, and he isn't home, perhaps you can find out where he is by
going through some of his old answering messages. Say, Eric called him a
couple of hours ago and suggested that Evan come over to his place for some
beers. Well, you could then call Eric and voila, you may connect with Evan.
Now, let us assume you have a girlfriend, and you suspect she might be
cheating on you, yet you do not wish to confront her about it without any
evidence, or certainty of her cheating. Well, her new beau probably thinks
her answering machine is secure, and calls leaving messages about their
upcoming dates, or various discussions of their relationship. If you can hack
her machine {actually, you might even look at the bottom (where the passcode
is usually printed...) to save time and energy.} you will be afforded with a
plethora of potentially incriminating evidence. Hehehe.
A similar application can be when you have a new love interest. Suppose
there is some woman you are interested in, but you aren't sure if she is
available. A little phone answering machine surveillance can provide all of
the answers, and then some... In case she asks her friends about you, you'll
know everything she does. Also, you will learn details about her life, and
schedule, the better to run into her "accidentally", or strike up a
conversation about "common" interests...
Now, if you know someone in the same profession, say musicians, and you call
his answering machine, and hear someone offering him a gig. You could call
that person back, and accept the gig in your name, saying the originally
called musician was unavailable, but suggested that you call. Then be sure to
erase the original message on your buddy's machine. He'll never be the wiser,
and you'll get more work. Though he may wonder why he isn't getting much work
anymore...
Changing the OGM is a good way to to get free phone calls. Change the message
to something like, "Hello?......Yeah.......Okay, sure, I'll accept the
charges!" Then you can third number bill a call to their number and when the
operator calls for validation, she thinks she's talking to a real person and
puts the call through for you.
After you hit the right key, the system will say, "Hello, xxx" where "xxx" is the box owner's name. The name would be something like, "Bob Smith" or "Mister Smith" or "Bob with Gimpstate Reality." You can either use the same methods as you do for the answering machines OR pull out the phone book and look up the owner of the mailbox, either at his/her home or business.
Call their home (or business) and when they answer, say, "Hi, this is Roy from Voice-Tel VoiceMail and we had another system crash this morning. I'm trying to get everyone's accounts back up here, etc, etc. I'm not sure if your message has been wiped out or not but I need your passcode so I can put that back in there for ya." To date, this has worked every time.
Once they give you the passcode, thank them and immediately call their voice- mail (before they do) and first change their passcode. Then, change their out- going message to something that's very insulting to the owner. Just play around in their box and have a really fun time. If you do all this after the voicemail's office has closed (hopefully for the weekend) you'll get to play in their box until the office reopens and the owner can call them and tell them what happened.
Some boxes will call the owner at home after he receives a message to let him know. You can change the number that the mailbox is programmed to call and you can sometimes change how many attempts the system will make to call and how often. In one case I changed the number to call to a guy's house I didn't like and the atttempts every five minutes. After I left a message on the voicemail, this poor guy would get a call every five minutes for eight hours straight. The system would ask him for a passcode that he didn't know so there was no way he could stop it. As long as I left a message every eight hours, he would continue to get calls all weekend, every five minutes. By the time all this ended, they had the local police and Ameritech Corporate Security (Yes, Jim Bayless) looking for the source.
As far as usefulness goes with voicemail hacking, don't ask me. Some systems will accept third party billing so you can use it for that. Other than that, I always just hacked them for the fun of bugging the hell out of the owner and enemies of mine.
1. Walk in and ask to speak to the manager. If the cashier tells you "no", grab her by her big fat head and say, "Listen, man, I'm not going to jail for you or nobody! Now let me speak to the manager." When the manager comes out, say, "Hi, I'm Darin Kempton, I think my dad spoke to you earlier on the phone?"
She'll be confused and ask you to explain. "Well, he came through here this morning (or yesterday) through the drive-thru and you forgot his Cheeseburger. I was supposed to come here to pick it up or get a refund or whatever." It never fails, she'll get a cheeseburger, give it to you and apologize.
2. A better way would be to do the same thing only call ahead and explain to them what the problem is. Tell them that you were there earlier and the dumb fuck working the drive-thru didn't put your Big Mac in the bag. Of course, don't say dumb fuck and you can choose whatever kind of food you'd like. Tell them you'll sent your son there to pick it up. If you pretend to be an annoyed dad you'll get more respect.
Usually when you call ahead in some places, they not only give you the food but they also include a "Free Meal" card. McDonald's is notorious for this and a free meal includes a soft drink, sandwich of your choice and a large fries. Just be polite over the phone but mad that your son has to "walk all the way back there." Sometimes, some places will give a cash refund but they usually (not always, though) want a receipt. If you can dig up an old receipt that'll work. Don't get greedy and say something like, "Yeah, you guys forgot 200 Cheeseburgers for me today. My son'll be there to pick 'em up." Call me crazy, but I don't think that would work.
Make sure your order is an ordinary one that people get all the time. If they have enough time on their hands and it's a strange order, they might go back through the tapes and say, "But we didn't SELL four number 2's today."
4. If the place doesn't offer free refills, get yourself a cup and fill it with water. Take it to the counter and say, "There's something wrong with my 7-Up it tastes really carbonated and gross." When they're about to give you another soda say, "Hey, could I have a Pepsi instead this time? Maybe that'll taste better." Or pick whatever soda you'd like to have.
5. If the fast food joint is one of those that let's you get your own drink, just ask for an ice water, dump out the water and fill it up with your soda.
This also works in some airport gift shops. If you want to buy something at one of those shops in the airport, tell them you work at one of the restaurants or bars in the airport.
Go outside and hand your ticket stub to your friend. Come back inside and sit down. Your friend now has a ticket stub to get in with. Repeat the process if you want another person to get in. It's not a good idea to try this on slow nights because they'll remember faces easier and won't fall for it. At busy theaters it's a sure thing. Opening night of any popular movie will always work.
And then there's always the old sneaking in the back door of the theatre that I need not go into detail about. It's childishly easy. When a movie lets out and all the people are rushing outside, go past them into the theater. If possible, get a schedule of the theatre's starting and ending times for each movie. This way, when your movie ends you can go directly to another auditorium and see a different movie.
When you're just about done with your Coke, but there's maybe a half inch left in the bottom of the cup, take it to the water fountain and fill the cup with water. Take it to the counter and tell them it's disgusting and you want a new soda. They'll give it to you.
Bring a dead roach to the movie with you. (Stop laughing and let me finish, dammit.) When you're just about done with your popcorn, drop the roach in the popcorn bag and take the bag to the counter and pretend to be horrified and demand to speak to the manager. No telling what you'll get out of this one. Could be anything from a free popcorn, a refund on your tickets or popcorn or some free movie passes. They're always nice to people who find creatures in their food.
Another thing that's not as profitable but helps if you need a little spare change is to hang out at a pay phone that gets used a lot. When someone starts to make a call on it, stop them and ask them if they'll give you their quarter if you get them a free call. I've never been turned down for this one. If you use your red box, it'll really impress them.
It's a trick getting the toilet paper up there just right. There's sort of a trap door in there so it makes it almost impossible to do but it is possible. Stuff enough in there to stop the coin flow but not too much to where a person using the phone will be able to tell there's anything in there. You don't want them removing it and stealing all your profits. To make sure it works before you leave the phone, put a penny in the coin slot. Since a pay phone doesn't accept pennies it'll come right back out. If your penny doesn't come back, you know it's working.
A few hours later, or the next day take out all of the toilet paper and a ton of quarters should come out with it. To make your pay phone the most profitable, you can put the other nearby payphones out of commission with a slegde hammer or by simply cutting the wires on them.
You can also make a list of codes for each other, each meaning a different thing. Like a collect call from "Mike" would mean, "I'll be home in about an hour." A collect call from "Axl" would mean, "Call me at the pay phone at 7-Eleven," and a call from, "Fred" would mean, "Listen, bitch, I've found another woman who can satisfy me sexually so I never want to see you again!" Well, you get the idea. It's a nice little quarter saver if you're poor. You can use a different name for every pay phone in town for her to call back.
If you REALLY need the money or you're just hard up to play the New Super- Advanced Mega Ultra Street Fighter VII Classic, you could squirt a bunch of super glue into the coin slot so when they tried to put money in it wouldn't work and they'd be sure to give you your money back. Sure, the store would have to spend hundreds of dollars fixing the machine but, hey, you got a quarter, didn't you?
This also works with soda machines, snack machines, pay phones, etc. In a lot of colleges they have those snack machines that carry food items that cost $2.25 or more! You can go to the nearest college book store or maybe the cashier in the cafeteria and they'll give you a refund or mail you a check for that amount.
Actual shoplifting isn't always neccessary, though. In a busy store you can take something off the shelf and bring it directly to the customer service desk for your refund. Here's a few tips for idiot shoplifters:
Due to all of the refund fraud (I actually know a couple of female that literally made a living off of K-Mart fraud), a lot of stores won't give you cash anymore if the refund is over ten bucks and you don't have a reciept. Instead, they'll mail you a check or a money order for the amount of the refund which is just as good as cash, you just have to wait a couple weeks to get it. K-Mart just started doing this a few months ago.
After a certian amount of salt water is poured in there, you'll be able to push the buttons to get sodas one after the other until the machine is totally emptied out. I usually take everything except for the diet soda. Diet soda sucks. I've only done this now three times but it's worked every time. Try not to leave any finger prints just in case they decide to investigate.
It seems to me that if you're putting in a constant flow of dollar bills into the machine for a 55 cent soda you'd get 45 cents back for every one you stole but for some reason you don't get any money, just the soda. Who am I to try and understand the physics of soda machines. This would probably work on snack machines with dollar bill slots too, although I've never tried. It's hard to find a secluded snack machine. Who's knows, maybe even dollar bill changer machines will work.
Anyways, you can either save these sodas, give them to friends or sell them to the tourists on a hot summer day. Imagine sitting next to a soda machine in front of K-Mart that sells sodas for .55 cents each. You could sit there with an ice chest full of them and sell them at .40 cents each or something. A few hours of that could probably get you a hefty profit, not to mention a short- term jail sentence.
I was told by a friend that you can take sulferic acid and pour it into the coin slot on a soda machine using a piece of paper to funnel it in. I've never tried this or seen it done, but it could work. (Wouldn't acid eat through the paper, though?) Chlorox or some other kind of bleach can be used as a sub for sulfuric acid.
