CELLULAR TELEPHONE ESN EMULATION -------------------------------- The term "Emulation" is used to describe the process of making two, or more, phones look alike to the cellular system. A basic understanding of the terms NAM and ESN is required before proceeding. NAM or "Number Allocation Module" is the term used to describe a cellular telephone's dealer programmable system parameters. These parameters include the users telephone number and other settings required to identify the phone to the cellular system. Older phones use an PROM chip that has to be programed or "burnt" using an PROM programmer. On all newer phones the NAM information can be re-programed at will from the handset be anyone possessing the relevant programing instructions, and in some cases a programming or "password" adaptor. ESN or "Electronic Serial Number" is the term used to describe a cellular telephones "un-alterable" fingerprint and is programed into the phone by the manufacturer. The ESN is commonly expressed as an eleven digit decimal, or eight digit hex number. The decimal format includes a three digit manufacturers identification and an eight digit unique serial number, the hex format includes a two digit manufacturers identification and a six digit unique serial number. When combined the NAM and ESN provide the cellular carriers a way of identifying the phone and determining whether to allow the phone to place a call. Whenever the phone is used it transmits this information to the cellular switch where it is compared to a data base of current subscribers. If the system recognizes the phone as being an out of area, or "roaming", subscriber a check is made with the home system. This check is either made during the first call, or more commonly these days before the first call is completed. CELLULAR FRAUD -------------- In the past it was often possible for hackers to change the ESN and NAM information and make one call before the system locked the unit out. The NAM and ESN information would be changed and another call could be completed. This is known as ESN "Tumbling" and over the last few years the Cellular Carriers have lost millions of dollars to this scam. It has been estimated that at the height of tumbling in New York City up to 30% of calls placed were fraudulent. To change the ESN the hacker would generally remove the phone's ESN chip and install a socket to take an easily reprogramable EPROM chip, the ESN could then be reprogramed at will. More recently people have reverse engineered certain manufacturer's software to allow simple reprograming using a lap top computer connected to the phone's data port. The Cellular industry has reacted to this in various ways. Initially the simple way to prevent tumbling was to ban all roaming customers from direct dialing, legitimate callers had to pre-register using a credit card to guarantee payment. Newer advanced software allows pre-screening of callers information and has now all but eliminated tumbling. In most service areas the ESN and NAM information is checked on power up or as soon as the SEND button is pressed, prior to allowing the completion of the call. The Cellular hackers have now turned to other ways of making fraudulent calls. The most common of these is to obtain a legitimate subscriber's telephone number and ESN and re-program a phone with this information, therefore making an exact clone able to make (and receive) phone calls. This method allows anything from a few days to a full month of "free" calls, and can go on indefinitely if the cloned number is a corporate account as executive's phone bills are rarely questioned. LEGAL EMULATION --------------- The above illegal cloning of subscriber's cellular telephones and the reverse engineering of manufacturer's software has been adapted by a number of legitimate companies. It is now possible to have more than one phone per cellular telephone number. Several companies are now offering legal cloning or emulation where for a fee of around $200-$300 they will program your second phone with the ESN of your currently active phone. To avoid fraud these companies often ask for a copy of a current cellular telephone bill showing the mobile number and subscribers name. This is then compared with picture ID to insure that the customer is a legitimate bill paying subscriber. Once a phone has been emulated the following should be noted: 1. If an attempt is made to use both phones at the same time and in the same system one of the following will occur: OUTGOING CALLS - First call will complete as normal, second phone will get a fast busy, system deny recording, or call will drop. INCOMING CALLS - Both phones may ring and call can be answered but might immediately drop. Strongest signal may ring and call can be answered. Neither phone will ring. 2. If one phone is in the home market and one is roaming both phones should work and it should be possible to call your own number. This depends on the roaming agreement between the two systems. In systems with "Automatic Roaming" or "Super Access" agreements it may be necessary to turn off the auto call forwarding to avoid problems, dial * O F F SEND in many locations. 3. If both phones are roaming in DIFFERENT systems do NOT attempt to have both phones turned on at the same time as your home system will probably generate a roam fraud message and CUT THE PHONE OFF! 4. If the secondary (cloned) phone is stolen call the carrier and have the mobile number changed, re-program the primary phone with the new number. Do not report the phone stolen as the ESN will be locked out and neither phone will work. If you know the secondary phone's ORIGINAL ESN report this as stolen and tell the carrier that the phone was not active. Nine times out of ten if the thief tries to activate the phone the hardware serial number (assumed to be the correct ESN) will be checked on the deny list and service will be denied. If the original ESN has not been reported stolen and the phone is activated using the hardware serial number the phone won't work as the ESN is incorrect! If the "correct" emulated ESN is read from the phone service will probably be denied if the thief tries to activate the phone on the same home system as the primary phone. This is because many systems do not allow two numbers on one ESN. The thief could activate service on an alternate system. You could prevent the emulated phone from working by having the ESN in the primary phone emulated to another phone, you can then report the phone's ESN as stolen. This is not recommended as using a phone with a stolen ESN would cause problems if you ever need to use the original ESN. Remember that legitimate emulation does not remove the original ESN, it simply adds some code to make the phone appear to have a different ESN. 5. If the primary phone is stolen you can report the theft, then have the secondary phone's ESN changed back to it's original or re programed to match another phone. This will usually be done for a nominal charge. As of April 1993 California Grapevine Communications offers ESN emulation for the following phones (call for latest list): AUDIOVOX: - 832, 832A, 1000, 4200A BC - 40, 45, 55, 55A, 65A, 410. CMT - 300A, 400, 405, 410A, 420, 450, 550, 600, 605, 750, 1700. CTR - 420A, 1900, 2000, CTX - 1500, 2500, 3100A, 3200A, 4000, 4100A PRT - 200 SP - 85, 85A, 95, TRANS - 420 NEC: 3700, 3800, 4000 M3800, M4500, M4600, M4700, M4800 P200, P300, P301 P9000, P9100 NOVATEL: 8300, 8301, 8305, 8305A, 8320, 8320A PTR825 PANASONIC: EB2500, EB2501 (TP500, 501) PIONEER: SEE MOTOROLA MOTOROLA: ALL MOBILES, TRANSPORTABLES AND BAG PHONES. ALL FLIPS, 8000 SERIES AND ULTRA CLASSICS PRIOR TO VERSION 9121. NO MICROTAC LITE'S (YET) TECHNOPHONE: MC905, MC905MKII/985/995 THE FOLLOWING MUST BE EMULATED TO SAME BRAND: SHINTOM, UNIDEN, GE The price for Emulation is $199.00 (mention this software) plus shipping. Proof of ID, valid Cellular account and social security number are required. Please call or write for further information. 25082 LUNA BONITA DRIVE, LAGUNA HILLS, CA, 92653 TEL: (714)643-8426 FAX: (714)643-8379 COPYRIGHT 1993 CALIFORNIA GRAPEVINE COMMUNICATIONS