___ _ _ | |_)|_). The Propaganda Press | | | . Basic Phreaking from Pay Phones Written by: THE PYRO (507) Date Written: August, 1987 -*- (P-C) Pseudo-Copyright 1987 by The Propaganda Press, International. Failure not to distribute this information is punishable under the Pseudo- United States Code (P-USC). You have been warned. -*- INTRODUCTION: So, you want to phreak from a pay phone, but you are in a bad situation. You need to make a call, yet you do not have an 800 extender or or 950 extender. And of course you have no quarter (or are too cheap to spend one). And to top it all off you don't have any sort of "box" or tone generator. So, what will you do? Well, by reading this file on basic ways to manipulate (aka: social engineering) various parts of the phone network you will be able to make that call. This file is broken down in to a few parts. They are: I. Charging the call to a OCC (Such as MCI, Sprint, etc.). A. Charge and then use a PIN. B. Third party charge (no PIN needed). II. Charging the call to a BBS. A. Call and Connect to BBS. B. Third party charge. PART I: In order to accomplish this method you must first have the dial-up extender number for an OCC (Other Common Carrier). Any OCC will do. I have found that MCI works well (but that is more preference than anything else). A. In this method you will be charging a call to the OCC. When the operator part of the call is complete then you will dial in the PIN you have, plus the other numbers in that particular OCC format to place the call. For demonstration I will use the local MCI at my disposal. 1. First, call up the OCC from the pay phone as if you were going to make a collect call (0+pre+suff). 2. When the operator answers tell them that you would like to charge the call to the number dialed. When they ask who is calling give them any name. It would help if you refrained from using your last name for obvious reasons. 3. Now it can get a bit tricky. In order to accomplish this next part you must change your voice to sound like someone else. And, it must be convincing. When the OCC answer with that drab yet perky tone quickly press the first # in the format needed to make a call through that OCC. Once this is pressed the tone should stop. Some OCCs allow you to press a # or * without it being part of the PIN, some do not. 4. Now, doing the best acting job you can politely answer (in your different voice) "HELLO?" In case you are lost, you are impersonating the person you have supposedly called. 5. If your acting job is good the operator will ask you "WILL YOU ACCEPT A COLLECT CALL FROM [your name]?" 6. In your acting voice simply answer "YES" 7. The operator will hang up. You should hear a click as he or she hangs up. Once the operator is gone continue with the rest of the numbers needed to finish the sequence. HINTS/NOTES: This method must be done quick. If you delay too long then you might time out on the OCC and have to start over again. B. In this method you do not have a PIN for the OCC you are charging to. Thus, you will do a third party billing to accomplish your mission. Again, I will demonstrate on my local MCI system. 1. Dial the number you wish to call in the collect call format (0+NPA+PRE+SUFF). 2. When the operator cuts in tell him/her that you wish to bill this call to another number. They will ask the number. Give them the OCC extender you are going to use. As in the above process, when they ask for your name give them any old name. 3. Once again you must slip in to your alternate personality in order to fool the stupid operator. When the operator calls the OCC number to verify your charging it to them answer by pressing any number to shut off the tone. The simply say in your acting voice "HELLO?" 4. The operator will ask you if you will accept a third party billing from the real you. You simply answer "YES" 5. Since your charging the call is approved the operator will now connect you to the number you really wish to call and thank you in a very friendly tone for using their service. They are so nice and helpful. HINTS/NOTES: In this form speed is not a critical issue. But remember to stay calm. PART II: In order to pull this form off you must be a VERY good actor and sometimes a bit lucky. You will need the number of a BBS or any line that produces a carrier tone. It would not be nice to charge to one of your favorite boards. I recommend the local 13 year old supEr ElitE piratE board. These boards usually work great. A. In this method you are going to charge and connect to the BBS. This works well for hacking a system, or logging on to a board you really do not care for. But, you must have a portable or a laptop to accomplish this method. You must also have good knowledge of your little system so that you can connect before the carrier tone drops. 1. Call the BBS as if you were charging the call (0+NPA+PRE+SUFF). 2. Tell the cheerful operator that you wish to charge the call to the number dialed. And once again, give the operator any old name. 3. When the BBS answer the phone use you by-now-perfected actor voice to answer something like "HELLO? DAMN MODEM, I CAN'T SHUT IT OFF" talk loud, otherwise the operator might not here you over the tone. 4. When asked if you will accept charges yell "YES!" 5. When the operator clicks off have you laptop modem pick up and bingo. Instant connect. HINTS/NOTES: This form can be trouble sometimes. It is also not very practical. But hey, it works. B. This method is much like PART I, SECTION B. The only difference is that the third party billed to is a BBS, not an OCC. Simply follow those instructions plus ITEM 3, from PART II, SECTION A and you will have no problems. HINTS/NOTES: Just like SECTION A of this part it can be trouble sometimes. And that damn carrier tone has been known to induce headaches at times. CONCLUSION: Well, I know that this covers the bare basics of pay phone phreaking. Like I said before, it is used when you have absolutely no resources or are too cheap to use them. There are, however, a few more notes that you should be aware of. They are: 1. Occasionally you will get an operator who knows what you are trying to do. I suggest you hang up and find another phone to try it from. I personally have had the operator send a AT&T Truck out to investigate. 2. Some OCC numbers will be listed as numbers that cannot accept collect calls. This usually happens because you have, or someone else has, charged a call or calls to it before. In my experience they have only flagged the roll-over line. That is, the main line you call. Set up a scanner to search out the actual lines you are rolled over to. I personally have a list of 50 lines that my local MCI uses. When one gets flagged for charged calls, switch to another. 3. I have used these methods to charge Alliance Teleconferences before, as well as go overseas. 4. Like I have said many times, these are basic ways to accomplish your mission. I am currently working on "Advanced Ways to Accomplish Other More Interesting Missions" All of this "mission" talk makes it seem like you are actually the conspirator trying to ruin the US like the secret service tries to make us look. Heh. Please excuse all typos and spelling errors. And remember, let's be careful out there.... _ (_ _ _ _-|- _ _ __)(_\| )(_ | (_)(_\| \/ ______________________/ NORTH - P R I V A T E (507)288-9572 3/12/24