PLA013: Petty Scams & Telephone TricksPetty Scams and Telephone Tricks
Mostly by RBCP
Written On April 8, 1990
Last Revision on January 09, 1995
For Informational Purposes Only. We're Not Responsible For Your Stupidity


Listed in this file is about every way that I've attempted and succeeded in 
swindling some place or person out of a few dollars (or cents). A lot of these 
methods should only be tried by the most pathetic and desperate person, as a lot 
of these tricks will get you just about enough to buy a meal or a joint. Also 
included are a lot of ways to bullshit your way around the telephone systems and 
companies.
Dialing A Phone That Can't Be Dialed:
Remember rotary pulse dialing? Before the modern days of touch tone dialing, you 
had to stick your finger in a hole and spin that stupid dial thing to call a 
number and that could really make exchange scanning a bitch. Today, you can hand 
a little kid a rotary dial phone and ask him to make a call on it and he'll look 
at you like you're crazy. "Where the hell are the buttons?"
If you've ever come across a telephone (whether it be rotary or touch tone) and 
for some reason there's a lock on the phone or the dialing keypad has been 
disconnected, don't dispair. You can still make a call using the prehistoric 
pulse dialing technology.
Let's say you want to dial the number "123-4567" so you pick up the phone and 
get your dial tone. Now quickly press and release the hang up button once. That 
should dial your number "1." Now repidly press and release the hang up button 
twice and you've dialed your "2" and so on. If you want to dial a zero, rapidly 
press and release the hangup button ten times. I actually got a disciplinary 
write up at work for teaching my co-workers how to do this after the manager 
disabled outgoing calls.
Sometimes if the owner of the phone has a lot of custom calling services like 
call waiting and three-way calling, this method of dialing might not work 
because it messes up the timing of the clicks and you always get a wrong number 
when trying it. Usually it will but I've come aceoss phone that won't dial that 
way. It also could depend on the type of phone being used. Another way to get by 
a locked dial is to buy a touch tone dialer from Radio Shack.
A lot of businesses out there have what's called a network phone system. This 
means they have a minerature phone company in the office which let's them 
restrict all kinds of things such as if one of their phone will be allowed to 
make outgoing calls. To avoid having employees chatting on the phone all day or 
a customer picking up the phone and dialing long distance, they usually restrict 
outgoing calls on a lot of the phones in the network.
Sometimes you can pick up the phone and hit "Line 1" or "Line 2" or whatever and 
get a dial tone, you just won't be able to push any of the buttons on the phone 
to dial out. If you try, you eiher get a busy signal or nothing. The solution to 
this is to buy a pocket tone dialer from Radio Shack (The $15.oo model is fine) 
and dial the number with that. That way, you're not pressing the network's 
buttons so it doesn't know anything's going on and you get your phone call, 
whether it be across the street or in Austraila.
If you pick up the phone and can't even get a dial tone, then you have to wait 
for someone to call you. When the phone rings, pick it up, answer their 
questions and get rid of them as quick as you can. When they hang up, stay on 
the line. In about a minute the phone company's equipment will reset and you 
should get a dial tone. From there just use your pocket tone dialer to dial out.
In airports you'll find a big console with all the local hotels listed on it. To 
reach one of the hotels you press the button next to the hotel you want to speak 
with. Usually, this setup is nothing more than a speed dialing phone with all of 
the hotels programmed into the memory buttons. Use your Radio Shack Pocket Tone 
Dialer to dial anywhere in the world on these phones. Same goes for the 
rent-a-car booth.
Exchange Scanning:
This can be done either with a computer program or manually with the provided 
chart. Basically, it's calling up every single number in an exchange and seeing 
what kinds of interesting things you can find. Computer hackers use exchange 
scanning to find carriers. For example, if a hacker's school phone line number 
is 254-7950 a hacker will dial every number from 254-0000 to 254-9999 to find 
the school's computer line. Hacker's are funny that way...
If you scan numbers where the first two numbers of the suffix is 00 or 99, 
you'll find a lot of phone company related numbers like loop lines, weird 
recordings, sweep tones, etc. If you're looking for this type of thing it's best 
to find out what the phone company's local office prefix is and use that. Like 
if the phone company's billing office number is 556-4200 call up every number 
from 556-9900 to 556-9999 or 556-0000 to 556-0099. A real handy recording to 
find is the one that says, "Please deposit 25 cents." You can drive an operator 
bugshit with this number.
Below is a chart that I made for hand scanning. You can do a whole 100 number 
exchange while you watch the Fresh Prince of Belle Aire. The chart is fairly 
easy to use. Let's say you want to dial every number from 618-254-9900 to 
618-254-9999. Fill in the Area Code box as "618", the Prefix box as "254", the 
xx box as "99" and fill in today's date. 
The following chart was lovingly made by the PLA 972/214 Division
      Area CodePrefixxxDate
      xxx0xxx1xxx2xxx3xxx4xxx5xxx6xxx7xxx8xxx9
      xx0xxx00xx01xx02xx03xx04xx05xx06xx07xx08xx09
      xx1xxx10xx11xx12xx13xx14xx15xx16xx17xx18xx19
      xx2xxx20xx21xx22xx23xx24xx25xx26xx27xx28xx29
      xx3xxx30xx31xx32xx33xx34xx35xx36xx37xx38xx39
      xx4xxx40xx41xx42xx43xx44xx45xx46xx47xx48xx49
      xx5xxx50xx51xx52xx53xx54xx55xx56xx57xx58xx59
      xx6xxx60xx61xx62xx63xx64xx65xx66xx67xx68xx69
      xx7xxx70xx71xx72xx73xx74xx75xx76xx77xx78xx79
      xx8xxx80xx81xx82xx83xx84xx85xx86xx87xx88xx89
      xx9xxx90xx91xx92xx93xx94xx95xx96xx97xx98xx99

The first box would be for 254-9900, the second for 9901, etc. Starting on the 
next row would be 254-9910, 254-9911, etc. For each thing you find, fill in the 
appropriate box, telling what you found. I usually use letters to represent 
different findings, like "D" means the number has been disconnected, "R" means 
it just rings and there's no answer, "B" means busy, etc. Make a few copies of 
this chart and have fun with it.
There should be a chart here, but I haven't made one yet for the HTML version. 
Try downloading the ASCII version if you really want it.
Oh, heh, heh, one thing I almost forgot to mention. The phone company doesn't 
like it when you exchange scan. I've done manual scanning in a LOT of different 
areas for long periods of time and nothing ever happened. However, if you have 
one of those computer wardialers that dials every single number in a prefix, 
they have equipment that detects this kind of thing.
I have friends that have used these programs and the only thing that happens is 
the phone company sends them a nasty letter telling them to knock it off or else 
or they might get a call from the phone company. I'm always reading, though, in 
publications like Phrack about people actually getting BUSTED for exchange 
scanning. I don't know why, maybe it's considered harrassment to call someone 
and hang up, let alone call 1000 people and hang up. Just be warned. If you are 
going to use a computer, use the random scan and not sequencial.
Privately Owned Pay Fones:
I'm a really nasty vandalizer of private pay phones. I hate them mostly because 
I can't red box off of them. What is a privately owned pay phone? These are the 
ugly pay phones you see that don't have any kind of cool local telephone company 
or AT&T logo on it. These are usually owned by a grubby old man who has a small 
empiree of his own pay phones around town and he goes around collecting all the 
profits from the phone for himself, sometimes splitting the profits with the 
owner of the business where his phone is located.
The long distance carrier for these phones is most likely someone you've never 
ever heard of that charges about three times as much as AT&T or Sprint would, 
and that's pretty bad. If you use your calling card on one of these phones, 
you'll notice when you get your bill what I'm talking about. A local call from 
one of these phone usually even charges you more than 25 cents.
A good thing about private pay phones is that the phone line it's using isn't 
actually classified as a pay phone line, it's classified as a business line for 
a regular business customer which is why red boxing won't work. Pick up one of 
these phones and dial "zero." If you can get one of their operators, ask them to 
connect you with AT&T. Now AT&T probably won't even know that you're calling 
from a pay phone line. She'll probably assume you're either calling from home or 
your place of business.
When AT&T answers, throw them a line like, "Yeah, I'm having trouble with my 
phone here. There's something wrong with the buttons and I can't get it to dial 
right. (Crying is optional) Could you try dialing the number for me?" and AT&T 
will be more than happy to help you dial that number. This works for local and 
long distance calls. Unfortunately, an operator can't dial a 0-700 or 900 number 
for you.
When dealing with some of the larger privately owned chains, the AT&T operator 
can tell that you're calling from a pay phone so a long distance call wont work.
Since these pay phones use a regular line you can plug your own phone to their 
line and dial any number you want, bypassing the pay phone itself entirely. The 
phone wires are usually installed very amateurly so you shouldn't have much 
trouble locating them.
When you find the phone wires, strip the outer covering, then strip the red and 
green wires, clip your phone to those two wires and start dialing random numbers 
in New Zealand. Don't actually cut the wires to the phone in half or the owner 
will be upset and hide the wires so you won't be able to do this anymore. Just 
strip them where no one will notice so you can come back and hook your phone up 
anytime you want. (This is called Beige Boxing, by the way.)
To make yourself look less suspicious, you can hook up your phone, quickly dial 
the number you're calling and then pick up the pay phone and unhook your own 
phone. To the casual observer, you're just talking on a pay phone like any 
normal person, not screwing the owner out of hundreds of dollars. If he doesn't 
have a block on the phone you can dial 0-700 Alliance and 900 numbers this way. 
And if he does have a block on the phone, call up the phone company's billing 
office and remove the block, pretending to be him.
A Shopper's Guide To COCOTS by Count Zero
(More On Private Pay Phones)
COCOT is an acronym for Customer Owned Coin Operated Telephone. In other words, 
a COCOT is a phone that is owned or rented by a paying customer (most likely, a 
hotel or donut shop). A COCOT is not a normal payphone. The telephone company 
doesn't own it, and the telephone line is usually a normal customer loop (unlike 
payphones, where the phone line is a "special" payphone loop, allowing the use 
of "coin tones" to indicate money dropped in!) So a COCOT may look and smell 
like a telephone company payphone, but it is not.
Why do COCOT's exist? Simple. Money! A customer owned payphone is money in the 
bank. You pay more for local calls and long distance is typically handled by 
sleazy carriers that offer bad/expensive service. The owner/renter of the COCOT 
opens the coinbox and keeps the money him/herself. Also, a particularly sleazy 
quality of COCOT is the fact that it does not receive incoming calls. This, of 
course, is because of money. If people are calling in to a COCOT, the COCOT is 
not making money and businesses always want to make as much money as possible 
even if it hurts the consumer. Think about it. It really sucks to call someone 
at home from a COCOT and then not be able to have him/her call you back to save 
money. "Guess I'll have to keep feeding the COCOT quarters!"
First of all, you must understand that the COCOT is a mimic. Essentially, it 
wants you to think that it is just a plain ol' payphone. Pick up the handset. 
Hear that dialtone? Hah! That dialtone is fake, synthesized by the innards of 
the COCOT. You are at the mercy of the COCOT. Remember a COCOT runs off of a 
normal customer loop so, unlike a telephone company payphone where you must 
deposit money to generate coin tones that are read by the central office, the 
security of a COCOT depends solely on the COCOT phone itself. It's as if you 
took your own phone and put a sign on it saying "Please put 25 cents in this jar 
for every call you make." COCOTs are not naive. They won't let you near the 
unrestricted dialtone until you fork over the cash-ola. Or so they think!
See, the Achilles' heel of the COCOT is the fact that all payphones must let you 
make 1-800 calls for free! It's not just a fact, it's the law. Now pick up the 
handset again and place a 1-800 call. Any 1-800 number will do. When they answer 
at the other end, just sit there. Do nothing. Ignore them. Wait for them to hang 
up the phone.
Here's an example. Dial 1-800-LOAN-YES. [Ring, Ring]...[click] "Hello, you wanna 
buy some money? Hello? HELLO?!" [CLICK] (You will now hear some static and 
probably a strange "waffling" noise, like chh, chh, chh, chh, chh.) [CLICK] 
DIALTONE!
Now what have we got here? A dialtone? Yes, you guessed it, the dialtone you now 
hear is the unrestricted dialtone of the COCOT's customer loop. So what? So I 
got an "unrestricted dialtone". Big Deal? You meathead, with an unrestriced 
dialtone, all you need to do is place a call via DTMF tones (the tones a 
touch-tone keypad generates).
Now, try dialing a number with the COCOT's keypad. Whoa, waitasec, no sound. 
This is a typical lame attempt at protection by the COCOT. Just whip out your 
Radio Shack pocket tone dialer and try calling a number, any number. Place it 
just as if you were calling from a home phone. Call a 1-900 sex line. Call Guam. 
You are free and the COCOT's customer loop is being billed.
Some COCOTs are more sophisticated at protecting themselves. Some will reset 
when they hear the dialtone. To get around this, make a loud hissing sound with 
your mouth into the mouthpiece after the 1-800 number hangs up. Get your tone 
dialer ready near the mouthpiece. When you hear the dialtone, quickly dial the 
first digit of the number you want to call. If you hiss loudly enough, you may 
be able to mask the sound of the dialtone and prevent the COCOT from resetting. 
Once you dial the first digit of the number you are calling, the dialtone will 
disappear (naturally). You can stop hissing like an idiot now. Finish dialing 
your free phone call. Also, some COCOT's actually disable the handset after the 
call hangs up (in other words you can't send DTMF tones through the mouthpiece). 
Oh well, better luck next time. However, most of the COCOT's I have run across 
only disable the DTMF keypad. So all you need is a pocket dialer to circumvent 
this!
Other things to know: Sure you can't call a COCOT, but it does have a number. To 
find out the COCOT's number, call one of the automated ANI services that tell 
you the number you're dialing from or dial a friend from the COCOT who has 
Caller I.D. so they can tell you the number. Now try calling the COCOT from 
another phone. You will hear one of two things: 1) synthesized voice: "Thank 
you" [DTMF tones] [CLICK] [hang up] or 2) a weird carrier.
A COCOT's number is only used by the company that built or sold the COCOT. By 
calling up a COCOT, a technician can monitor its functioning, etc. In case 
number 1, you must enter a 3 or 4 digit password and then you'll get into a 
voice menu driven program that'll let you do "maintenance" stuff with the COCOT. 
In case number 2, you are hooked to the COCOT's 300 bps modem (Yes, a modem in a 
payphone). Likewise, if you can figure out the communications settings, you'll 
be into the COCOT's maintenance routines. Personally, I haven't had much luck 
(or patience) with calling up and hacking COCOT maintenance functions. I just 
like making free phone calls from them!
RBCP Notes on COCOTS:
In Austin, Texas they have some private pay phones called a Fox Fone. Pretty 
lame name if you ask me. When you dial an 800 number on one of these it has the 
nerve to ask you to deposit a quarter. Now, to get to the unrestricted dialtone 
a quarter isn't a bad investment, however I've found that it doesn't ask for a 
quarter if you dial 102880 to get AT&T. When AT&T answers, you're home free.
When you dial a long distance call legitamately on a private COCOT, the COCOT 
will dial a sequence of numbers like their authorization codes, etc. So when you 
get the unrestricted dialtone and try to dial a number direct like 
1-512-370-4680 you'll get a "your number cannot be completed as dialed" message 
or a busy signal. To get around this, instead dial 10288-1-512-370- 4680 and 
your call should go through. 
If you're limited on the number of digits you can dial, just dial "0" from the 
unrestricted dialtone and ask the local operator for AT&T. Then ask AT&T to dial 
a long distance number for you. If you do it this way, you can't dial 700 and 
900 numbers but if you use your Radio Shack tone dialer, it's no problem. Dial a 
700 number like 10288-0-700-456-1002.
Sometimes the AT&T operator will know that you're calling from a COCOT and won't 
dial any free calls for you, but when she hangs up you can still use your tone 
dialer (or the fone's keypad) to dial long distance.
Directory Asisstance:
To get any listed phone number in the United States, all you need to do is dial 
"1-AREA CODE-555-1212." If you don't know which area code the number's in, just 
make up one or call local directory asisstance and ask that operator what any 
area code is. Local directory asisstance can be reached at "411", "1-411" or 
"1-555-1212." It differs from area to area. Pay phones that offer "411" won't 
charge you for information. Some areas I've lived in only will give me a phone 
number and say that if I want the address, dial 555-3131.
Toll free information can be reached at 1-800-555-1212 and of course, there is 
no charge for this call. There's also directory asisstance for 900 numbers which 
is 1-900-555-1212. International Information can be reached by dialing 102880 
and asking for it.
1-800-COLLECT:
I'm sure that most of you are familiar with those annoying commercials for MCI's 
1-800-COLLECT and AT&T's 1-800-OPERATOR services. These two services allow you 
to call people collect using an automated service. For people like us, it 
provides a free nation-wide messaging service.
You dial 1-800-COLLECT. The automated operator asks you to enter the area code 
and number you'd like to call collect. Then it say, "At the tone, please say 
your name...(Beep)" where you get about five seconds to say your name.
Now instead of saying your name though, you can say a quick message like, "This 
is Ron, call me at 801-234-7448" or "Honey, I'll be home in two hours" or "Help 
me, I'm trapped in a phone booth in a black neighborhood!" The person receiving 
the call simply refuses the charges after they hear your message and nobody pays 
for it. 1-800-COLLECT is the best one to use because they give you the most time 
to "say your name."
Ordering Free Phone Books From All Over The World:
Some people collect stamps. Others collect rocks. And certain serial killers 
collect body parts. But imagine the fun of starting your very own collection of 
telephone directories from around the world. You can be the proud owner of 
directories from great cities such as London, Melbourne, Los Angeles, Miami and 
little podunk towns like Celina, Ohio and Roscoe, South Dakota where the "Local 
Attractions" section is only two paragraphs long... "Well, as far as local 
attractions here is Jessup, Iowa go, we got Herb's brand new paint job on his 
tool shed and Toothless Jim here plays a helluva banjo..."
Ordering the directories is quite simple. You can either bill the cost of the 
phone books to your home phone or have them send you a bill for the amount. The 
beauty part of it all is that you can bill it to any phone number in the United 
States. In the past, I've billed my phone books to pay phones, restaurants that 
give me bad service, the White House and Ameritech Corporate Security.
The directory offices never seem to check up on the number you're billing to nor 
do they check to make sure that the billing phone number matches the billing 
address. Even if the person you'd like to bill it to has a block on their phone, 
you can still charge directories to their number and a single overseas phone 
book can go for a few hundred dollars. While I'm sure the person you're billing 
to can probably have the charges removed, it sure it a fun way to make someone 
you hate lose peace of mind.
If you're going to order a lot of phone books, your biggest problem would be 
where to ship your phone books. It's best to get a post office box and have them 
shipped there. I had phone books comming to me regularly for an entire six 
months at a post office box and was never questioned once about it, although I 
started getting letters saying I'd better pay them or else and Gloria, who 
worked the front desk at the post office always wanted to know why I got so many 
phone books all the time. (I told her I was an asisstant manager for a 
telemarketing firm.)
You could also have it shipped to your next door neighbor or any vacant house 
for you to pick up later. Occasionaly I even send one to my home and nothing 
ever happens except that I get a letter every few months from them wanting their 
money. Below is a list of numbers you can call to order directories.
DonTech.........................(800)-541-8000 
Ameritech.......................(800)-xxx-xxxx 
AT&T............................(800)-xxx-xxxx 
U.S.West Directory Source.......(800)-422-8793
Pick a number and tell them you want a directory from wherever and give them the 
billing number and address to be shipped to. In less than two weeks you should 
recieve it. One thing to remember, though, is that you ask them to deliver the 
books by regular U.S. mail unless you'll be somewhere to sign for U.P.S. A lot 
of post offices won't accept U.P.S. Enjoy your new hobby!
Employee News & Information Lines:
The phone company has a phone number that their employees can call up and find 
out what's new with the company, how the company's stock is doing, what new 
advances in phones have been discovered and how they're catching people like us. 
To get a newsline number, call the phone company's main office and ask them for 
it. Sometimes they won't know what you're talking about but keep pestering them 
until they give it to you. Below is a small list of newslines.
        Bell Atlantic....................(800)-647-NEWS
        Ameritech........................(800)-893-LINE
                                             (312)-917-9797

Main Numbers & Employee Locators:
An employee locator is a service for Bell employees that helps you find out 
exactly what department any employee of Bell works for. Sometimes automated, you 
enter in the name of the employee on your touch tone phone and the computer will 
rattle off their work phone number, street address and state. Most locators have 
a live operator who you just ask for the information.
Usually the employee locator is the same number as the main number. To get this 
number, call up directory asisstance and ask them for the phone company's main 
number. Call the main number and if they're not the employee locator, ask them 
for that number. In most cases, it's given to you, no questions asked.
If you can't get the phone company's main number from directory asisstance, try 
calling the billing office and ask them. Below is a short list of numbers.
        Bell Atlantic (West Virginia)..........(304)-954-6202
        Bell Atlantic (Virginia)...............(804)-225-6300
        Cincinnati Bell (Ohio).................(513)-397-5775
        South Central Bell (Jackson, Miss.)....(601)-961-1327
        Southwestern Bell (Little Rock, Ark.)..(501)-373-9800
        U.S. West (Western U.S.)...............(800)-879-4357
        Ameritech (Indianapolis, IN)...........(317)-265-2266
        Southern Bell (South Carolina).........(800)-336-0014
        Pacific Bell (Los Angeles, CA).........(213)-339-6622

Partylines:
An interesting way to meet new people and sometimes learn new phone tricks is to 
call a party line. You can find tons of party line phone numbers in magazines 
such as "Rolling Stone" and "Spin." A majority of them are some kind of sex 
line/lesbian line/gay line/weirdo line but sometimes you find a nice, normal 
chat line that you can talk to people on.
Every now and then you'll meet a phone phreak who'd be happy to exchange calling 
cards with you or teach you a few new tricks. And a lot of average, honest 
people hang out on them but learn some method of calling for free so they can 
talk without going broke. These lines can be VERY addictive. Only regular long 
distance charges apply on most. Some of them want a credit card.
        Hotel California........................(801)-234-SHIT
        Underground Party Line..................(515)-945-6700

Automatic Number Identification (ANI):
When you dial an ANI phone number, a computer voice will tell you what number 
you're calling from. There's a lot of ANI numbers out there but my favorite one 
is 1-800-MY-ANI-IS. Call this number and a computer voice simply says, "Your ANI 
is xxx-xxx-xxxx" and hangs up. I have no idea who sponsors this or who pays for 
it but it's been there for a long time. Zak claims that ANI knows the future and 
the past by dialing things like 1-800-MY-ANI-WAS or 1-800-MY-ANI-WILL-BE but for 
some reason I don't believe him.
If you have a friend with Caller I.D., call the friend from the phone you want 
to identify and your friend can read the number to you. If you don't have any 
friends, call a business who has Caller I.D. and tell them that you're the phone 
company testing their Caller I.D. and ask them to read back your number.
Hacking Telephone Answering Machines by Doctor Pizz & Cybersperm:
----------------------------------------------------------------
It seems that lately there is very little discussion of one of the most
simple but useful and rewarding forms of electronic information gathering,
hacking the telephone answering machine.  Almost everyone has one of these
wonderful devices these days, to catch important messages while they are away
from their phones, or to screen important telephone calls.  Nowadays, they
typically have the added advantage of being accessible from remote telephones,
so one needs to simply call his or her answering machine, enter their secret
code, and then either retrieve new messages, or listen to anything they had
previously recorded on the incoming messages tape, or perform any of a set of
additional functions determined by which key they press on their touch tone
phone.  They also typically ignore the fact that virtually anyone else can
gain access to their messages by entering the appropriate code.  Hence this is
a wonderful system to gather information from anyone without their knowledge,
especially if they are technologically illiterate.

For the most part, there are two main types of "electronic password" used by
these systems.  They are amazingly simple to crack, as they are typically only
2-digit or even 1-digit numbers. On some machines, the code must be entered
before the outgoing message is over, on others, it must be entered after the
outgoing message, and on more sophisticated models, it can be entered at any
time.

MODERN 2-DIGIT PASSCODE SYSTEMS:
These are the most common systems in use today, typically made by Panasonic,
AT&T, etc. In these systems, the code can be entered before during or after
the beep tone.  For security reasons, we recommend BEFORE the beep tone, so
your intrusions are unnoticed...  We will begin by discussing how to identify
the passcode.

Now, the question of how to hack their code.  Well, this is so simple, you
don't even need a computer to do it.  You can just enter all 2-digit
combinations until you get the right one (usually signalled by a series of
beeps on the other end).  A relatively crude way was to enter each number in
sequence 01, 02, 03, 04,...,99.  This works, but may take too long to enter
all numbers within the 20-30 second window we typically have before the beep
(The best time to play arounnd, as any tones entered after the beep will be
recorded on his incoming messages tape, and could let him know something is
up...).  It is also important to stop as soon as you hit the right number, as
the additional entered numbers may be interpreted by the answering machine as
codes, and cause you to delete all their messages, or record a new greeting,
etc.  That is really asking for trouble, and may cause them to try and change
their password (though it's usually only possible to choose from a range of
three consecutive numbers anyway...).  Still, you need to be careful not to
let them catch on, eh?

A more sophisticated and fast way to do this is to take advantage of the fact
that such machines typically do not read two numbers at a time, and discard
them, but just look for the correct sequence, reading one at a time. In other
words, you can enter all 100 possible codes with roughly 1/2 the number of
keystrokes.  Just enter as follows:

0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9,etc.

By reading in one phase we get:

0 0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 0,9 1,1 2,1 3,1 4,1 5,1 6,1 7,1 8,1 9,etc.

In the other phase we get:

  0 1,0 2,0 3,0 4,0 5,0 6,0 7,0 8,0 9,1 1,2 1,3 1,4 1,5 1,6 1,7 1,8 1,etc.

So by proceeding as follows we enter the following matrix sequentially,
encompassing all possible 2 digit numbers:


0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9
    1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9
        2 2 3 2 4 2 5 2 6 2 7 2 8 2 9
            3 3 4 3 5 3 6 3 7 3 8 3 9
                4 4 5 4 6 4 7 4 8 4 9
                    5 5 6 5 7 5 8 5 9
                        6 6 7 6 8 6 9
                            7 7 8 7 9
                                8 8 9
                                    9 0

The last zero is important, as it completes the cycle, and allows for the code
9 0, which is the only one not as yet allowed for.  I must emphasize the
importance of quitting as soon as you get the correct code, and also do not
keep going after the beep, if you are on a modern 2-digit access code system.
This way, you can record the passcode for your future reference, and prevent
detection.

      Now, we shall get on to the question of how to use their system, once
you've broken in.  In general, it is recommended to obtain a copy of the
owners' manual for various machines, but I have summarized some of the basics
below.

PANASONIC
Here are the codes for a Panasonic Easa-phone KX-T1450.  The KX-T2420 is
identical without Room Monitor function  In this case, strange things happen
when you enter 5:

1 = Back Space (Rewind the OGM tape)
2 = Skip Forward (Fast forward the OGM tape)
3 = Reset (Go back to the beginning of the OGM tape.  MAY CAUSE ERASURE!!!)
4 = Memory Playback (Listen to new messages)
5 = Room Monitor (!!!! Listen to what is going on in the room NOW !!!!)
                 (This is only available on some models...  But, try it...)
7 = OGM-REC (Record a new greeting!!!)
9 = OGM-STOP (Stop recording the new greeting)
* = OGM Skip (Don't Listen to the OGM)
0 = Turn off the machine !!!!!

To set to the answer mode remotely,
   1. Dial the phone number
   2. Wait 15 rings and hang up

To turn off the unit remotely (!!),
   1. Dial the phone number
   2. Push the code number, wait for the beep, enter 0, and hang up.

Panasonic answering machines also respond to the user with a series of codes
which I will now outline.  If you hear something different, you may not be on
a Panasonic system.

1 long beep  : This is the "beep" after which people can leave their messages.
               Also, this is sounded when the correct passcode is entered from
               a remote telephone. (Same sound- Hint for software developpers)
               It sounds when the tape has fully rewound, and after each
               message is played back in entirety.
3 short bps  : This sounds after the last message has been played back.
2 short bps  : (10 seconds later) You are then being recorded - marker message
6 short bps  : End of the incoming message tpe
6 short bps  : (Quickly) Tape Broken (either incoming or outgoing)

Also, after entering the correct code, and after the one long beep, you will
hear n additional short beeps, where n is the number of new messages since the
last time the messages were retrieved.  Remember, you can listen to earlier
ones on the same tape, by additionally backspacing from the first new message.

Anyway, that is a basic summary of the Panasonic answering machine system for
this machine.  Many machines unfortunately do not have the Room monitor
function, so you can not see if you left your TV on, or anything like that...
Also, not all systems are identical, but on Panasonic machines, the numbers 1-
4 are the same, so this is the most important thing for you to remember
anyway...

AT&T
On AT&T machines, like the Answering System 1304, the passcode is again a 2-
digit number enterable before, during, or after the beep.  Follow the same
guidelines as above.

After you enter the correct code on these machines, the system will
automatically begin to play back new messages.  This is one key way to
distinguish these machines from the Panasonic ones discussed above.

To summarize the key functions for the AT&T system, look below:

2     Rewind tape (tape rewinds for as long as this key is depressed)
3 3   Clear messages (reset the tape to the beginning.)
5     Fast Forward (tape ffwds for as long as this key is depressed)
7     Replay messages from the beginning
8 8   Turn off the answering machine
*     Record a memo (After listening to messages)   OR
      Skip the greeting (w/o entering code)
0     Turn on the machine (after hearing two beeps)
#     Pause (for 5-7 seconds)

Basically this system is less sophisticated than the Panasonic.  You cannot
change the OGM remotely (Damn!).  As seen above, the codes are also quite
different, but fortunately they are easily distinguished by how they answer
after the security code is entered.  The AT&T plays the messages, while the
Panasonic just beeps to tell you how many new messages are waiting.  Here
also, the rewind and fast forward functions operate for the length of time you
depress the 2 and 5 keys respectively.  On the Panasonic, they reewind or fast
forward for 15 seconds.  Also, this system has a pause feature.  By entering
the # sign, you can pause for a few seconds while listening to a message.  One
extra safety (from your perspective...) feature is that on this system you
cannot erase messages until they have all played back, so you have less risk
of fucking up someone's system if it is an AT&T.  You cannot change his
greeting, and it is difficult to accidentally erase his messages.  If you wish
to do so, however, you must hit the 3 key twice after listening to the
messages in their entirety.  To record a memo (why would you want to do
this???), you can press the * key after you hear 5 beeps (after listening to
the messages).  Then begin to record.  Also, the * key can be used before the
message is finished to skip listening to the OGM (useful for long distance
callers who are actually paying for the calls...) without the need for
entering a security code.  To turn on the system from remote points, you need
to let it ring ten times, and after it answers with 2 "beeps", hit the 0 key.
It will subsequently be on.  Similarly to turn it off, just enter 88.  If the
machine answers the phone with no greeting, and just 2 beeps, it means the
tape is full.  You can now enter the security code (without risk of them
recording the BEEPS!!!) and listen away for a long time!!!  Basically, this
sums up the properties of the two most common systems I've encountered of the
2-digit passcode variety.
SINGLE DIGIT PASSCODE MACHINES:

On some old model Panasonic and Phone Mate systems, the secret entry passcode
is only a one digit number(!!!).  On these primitive systems, one merely
enters the correct number, during the message, and playback begins. The other
codes are simple to derive, and just for the sake of making this hobby a sport,
I will not give details for these systems.  It is easy enough to figure them
out, and on these systems, it is hard to screw things up, as there is little
you can do anyway.

APPLICATIONS:
This can be a rewarding adventure if you decide to follow those instructions
I will point out some of the potentially entertaining, useful, and/or
informative applications of this technology.

As the true weirdos that we are, we shall begin with what we consider the
truly entertaining applications...  If you have ever read the Village
Voice, Screw or other such newspaper, you will notice a large number of
advertisements for "unlicensed massage parlors", "Oriental relaxation spas",
"Escort services", etc.  Call some of those numbers, preferrably at off-duty
hours (6-9 AM??) and try to hack their answering machine codes, listen to
their messages, and let the fun begin.  You can hear lots of perverts, and
lowlifes making appointments for "services" about which they are sometimes
graphic.  Also, they often leave telephone and credit card numbers (What
fun!!!).  In case they are married, think of the blackmail potential...

Further, these "adult entertainment companies" also often run help wanted ads
in the Village Voice, and other such publications.  Call these, and you will
get a plethora of phone numbers for nubile young women who might believe you
are the proprietor of the establishment in question.  You might be able to con
some "free samples" as a sort of "job interview"... (hehehe) Especially given
the illegal activity they desire to become involved in, they will be in no
position to complain when they find out you are not for real. Also, this way,
the girls are often not so jaded as the old pros. They will be trying to
impress you if you get my drift, so you'll "hire" them.


Let us move on to the informative espionnage type of application of this
technology.  One could very easily use this technology to listen to the
messages of friends, and see what they are up to.  If you are trying to call
your buddy Evan, and he isn't home, perhaps you can find out where he is by
going through some of his old answering messages.  Say, Eric called him a
couple of hours ago and suggested that Evan come over to his place for some
beers.  Well, you could then call Eric and voila, you may connect with Evan.

Now, let us assume you have a girlfriend, and you suspect she might be
cheating on you, yet you do not wish to confront her about it without any
evidence, or certainty of her cheating.  Well, her new beau probably thinks
her answering machine is secure, and calls leaving messages about their
upcoming dates, or various discussions of their relationship.  If you can hack
her machine {actually, you might even look at the bottom (where the passcode
is usually printed...) to save time and energy.} you will be afforded with a
plethora of potentially incriminating evidence.   Hehehe.

A similar application can be when you have a new love interest.  Suppose
there is some woman you are interested in, but you aren't sure if she is
available.  A little phone answering machine surveillance can provide all of
the answers, and then some...  In case she asks her friends about you, you'll
know everything she does.  Also, you will learn details about her life, and
schedule, the better to run into her "accidentally", or strike up a
conversation about "common" interests...

Now, if you know someone in the same profession, say musicians, and you call
his answering machine, and hear someone offering him a gig.  You could call
that person back, and accept the gig in your name, saying the originally
called musician was unavailable, but suggested that you call.  Then be sure to
erase the original message on your buddy's machine.  He'll never be the wiser,
and you'll get more work.  Though he may wonder why he isn't getting much work
anymore...

Changing the OGM is a good way to to get free phone calls. Change the message
to something like, "Hello?......Yeah.......Okay, sure, I'll accept the
charges!" Then you can third number bill a call to their number and when the
operator calls for validation, she thinks she's talking to a real person and
puts the call through for you.

Fun With Voicemail
Voicemail is a little more complex to hack than answering machines are. I've 
experimented with a lot of voice mail systems and they all work pretty much the 
same way. When you call your own voicemail to retrieve your messages, you have 
to hit a certain key so you'll be prompted for your passcode. Usually it's 
either the "#" key or the "*" key. On some systems it'll be the "0" key.
After you hit the right key, the system will say, "Hello, xxx" where "xxx" is 
the box owner's name. The name would be something like, "Bob Smith" or "Mister 
Smith" or "Bob with Gimpstate Reality." You can either use the same methods as 
you do for the answering machines OR pull out the phone book and look up the 
owner of the mailbox, either at his/her home or business.
Call their home (or business) and when they answer, say, "Hi, this is Roy from 
Voice-Tel VoiceMail and we had another system crash this morning. I'm trying to 
get everyone's accounts back up here, etc, etc. I'm not sure if your message has 
been wiped out or not but I need your passcode so I can put that back in there 
for ya." To date, this has worked every time.
Once they give you the passcode, thank them and immediately call their voice- 
mail (before they do) and first change their passcode. Then, change their out- 
going message to something that's very insulting to the owner. Just play around 
in their box and have a really fun time. If you do all this after the 
voicemail's office has closed (hopefully for the weekend) you'll get to play in 
their box until the office reopens and the owner can call them and tell them 
what happened.
Some boxes will call the owner at home after he receives a message to let him 
know. You can change the number that the mailbox is programmed to call and you 
can sometimes change how many attempts the system will make to call and how 
often. In one case I changed the number to call to a guy's house I didn't like 
and the atttempts every five minutes. After I left a message on the voicemail, 
this poor guy would get a call every five minutes for eight hours straight. The 
system would ask him for a passcode that he didn't know so there was no way he 
could stop it. As long as I left a message every eight hours, he would continue 
to get calls all weekend, every five minutes. By the time all this ended, they 
had the local police and Ameritech Corporate Security (Yes, Jim Bayless) looking 
for the source.
As far as usefulness goes with voicemail hacking, don't ask me. Some systems 
will accept third party billing so you can use it for that. Other than that, I 
always just hacked them for the fun of bugging the hell out of the owner and 
enemies of mine.
Newspapers
A little trick that I picked up in Galveston, Texas was to deposit my .50 cents 
into the newspaper machine and take out every newspaper in there. I would do 
that with several machines until I had a good size stack and trot over to 
Wal-Mart and impersonate the newspaper salesperson. The others standing out 
there selling only got 50% of the profits while I was getting 100% minus my 
$1.00 investment. I was always worried that the Houston Post truck would come by 
and ask me who the hell I was but he never did.
Free Meals
Most fast food restaurants have this silly little policy that goes, "The 
customer is always right!" Therefore, they lose a lot of money to people like 
me. There's a few ways that you can get free food from them.
1. Walk in and ask to speak to the manager. If the cashier tells you "no", grab 
her by her big fat head and say, "Listen, man, I'm not going to jail for you or 
nobody! Now let me speak to the manager." When the manager comes out, say, "Hi, 
I'm Darin Kempton, I think my dad spoke to you earlier on the phone?"
She'll be confused and ask you to explain. "Well, he came through here this 
morning (or yesterday) through the drive-thru and you forgot his Cheeseburger. I 
was supposed to come here to pick it up or get a refund or whatever." It never 
fails, she'll get a cheeseburger, give it to you and apologize.
2. A better way would be to do the same thing only call ahead and explain to 
them what the problem is. Tell them that you were there earlier and the dumb 
fuck working the drive-thru didn't put your Big Mac in the bag. Of course, don't 
say dumb fuck and you can choose whatever kind of food you'd like. Tell them 
you'll sent your son there to pick it up. If you pretend to be an annoyed dad 
you'll get more respect.
Usually when you call ahead in some places, they not only give you the food but 
they also include a "Free Meal" card. McDonald's is notorious for this and a 
free meal includes a soft drink, sandwich of your choice and a large fries. Just 
be polite over the phone but mad that your son has to "walk all the way back 
there." Sometimes, some places will give a cash refund but they usually (not 
always, though) want a receipt. If you can dig up an old receipt that'll work. 
Don't get greedy and say something like, "Yeah, you guys forgot 200 
Cheeseburgers for me today. My son'll be there to pick 'em up." Call me crazy, 
but I don't think that would work.
Make sure your order is an ordinary one that people get all the time. If they 
have enough time on their hands and it's a strange order, they might go back 
through the tapes and say, "But we didn't SELL four number 2's today."
Want a free soda to go with your Big Mac and Fries?
3. Find an old cup. Either get one off of a table that hasn't been cleaned yet 
or one out of the trash can making sure that it's not all slimey. Punch a very 
small hole in the bottom of the cup with your keys or pocket knife to start a 
small leak in the cup. Most fast food places offer free refills so take your 
leaking cup to the counter and say, "I'd like my refill and this cup's got a 
hole in it." They'll give you a refill and a new cup."
4. If the place doesn't offer free refills, get yourself a cup and fill it with 
water. Take it to the counter and say, "There's something wrong with my 7-Up it 
tastes really carbonated and gross." When they're about to give you another soda 
say, "Hey, could I have a Pepsi instead this time? Maybe that'll taste better." 
Or pick whatever soda you'd like to have.
5. If the fast food joint is one of those that let's you get your own drink, 
just ask for an ice water, dump out the water and fill it up with your soda.
Employee Discounts
A majority of the stores in any mall offers a discount for anyone who works 
anywhere in the mall. Always remember that you are an employee of the mall. When 
you purchase something, ask the cashier if they offer the mall employee 
discount. If they do, they'll knock off 10 or 20 percent of your purchase. I've 
been doing this forever and have never been asked to prove that I work in the 
mall. They always just take your word for it.
This also works in some airport gift shops. If you want to buy something at one 
of those shops in the airport, tell them you work at one of the restaurants or 
bars in the airport.
Free Movies
If the theatre you're at has a doorman that rips tickets, and you want to see 
the movie with your friend (or friends), it's easy to trick him. Purchase one 
ticket for all three of you. Go in, let him rip your ticket and go sit down. A 
second later, get up and approach the doorman, "Excuse me, sir? Could I go to my 
car for a second. I forgot to turn off my headlights. I can't seem to find my 
ticket stub anywhere. My memory ain't what it used to be since I got hit by 
lightning." Unless he's a total asswipe, he'll let you go out to the parking 
lot. If he won't, demand to speak with the manager and he will let you.
Go outside and hand your ticket stub to your friend. Come back inside and sit 
down. Your friend now has a ticket stub to get in with. Repeat the process if 
you want another person to get in. It's not a good idea to try this on slow 
nights because they'll remember faces easier and won't fall for it. At busy 
theaters it's a sure thing. Opening night of any popular movie will always work.
And then there's always the old sneaking in the back door of the theatre that I 
need not go into detail about. It's childishly easy. When a movie lets out and 
all the people are rushing outside, go past them into the theater. If possible, 
get a schedule of the theatre's starting and ending times for each movie. This 
way, when your movie ends you can go directly to another auditorium and see a 
different movie.
When you're just about done with your Coke, but there's maybe a half inch left 
in the bottom of the cup, take it to the water fountain and fill the cup with 
water. Take it to the counter and tell them it's disgusting and you want a new 
soda. They'll give it to you.
Bring a dead roach to the movie with you. (Stop laughing and let me finish, 
dammit.) When you're just about done with your popcorn, drop the roach in the 
popcorn bag and take the bag to the counter and pretend to be horrified and 
demand to speak to the manager. No telling what you'll get out of this one. 
Could be anything from a free popcorn, a refund on your tickets or popcorn or 
some free movie passes. They're always nice to people who find creatures in 
their food.
Pay Phones
If you're the type that happens to have a handy list of stolen calling card 
numbers, credit card numbers or a red box, you can hang around a pay phone and 
sell long distance calls to tourists. You can make up your own rates just like a 
real telephone comapany, charge extra for overseas calling, etc.
Another thing that's not as profitable but helps if you need a little spare 
change is to hang out at a pay phone that gets used a lot. When someone starts 
to make a call on it, stop them and ask them if they'll give you their quarter 
if you get them a free call. I've never been turned down for this one. If you 
use your red box, it'll really impress them.
Pay Phone Stuffing:
I read about some guy in the 70's that made around $100 a day, stuffing pay 
phones at the college until he was caught. Basically, shove a bunch of toilet 
paper up the change slot on a pay phone.
It's a trick getting the toilet paper up there just right. There's sort of a 
trap door in there so it makes it almost impossible to do but it is possible. 
Stuff enough in there to stop the coin flow but not too much to where a person 
using the phone will be able to tell there's anything in there. You don't want 
them removing it and stealing all your profits. To make sure it works before you 
leave the phone, put a penny in the coin slot. Since a pay phone doesn't accept 
pennies it'll come right back out. If your penny doesn't come back, you know 
it's working.
A few hours later, or the next day take out all of the toilet paper and a ton of 
quarters should come out with it. To make your pay phone the most profitable, 
you can put the other nearby payphones out of commission with a slegde hammer or 
by simply cutting the wires on them.
Free Collect Calls
Give your girlfriend the phone number to the pay phone. When you want to talk to 
her, call her collect, using a code name that she'll know like, "Peterhead." 
When the operator asks her if she'll accept the charges, she'll say, "Hell no, 
not from THAT asshole!" Then she hangs up the phone and calls you right back at 
the pay phone so neither one of you are charged.
You can also make a list of codes for each other, each meaning a different 
thing. Like a collect call from "Mike" would mean, "I'll be home in about an 
hour." A collect call from "Axl" would mean, "Call me at the pay phone at 
7-Eleven," and a call from, "Fred" would mean, "Listen, bitch, I've found 
another woman who can satisfy me sexually so I never want to see you again!" 
Well, you get the idea. It's a nice little quarter saver if you're poor. You can 
use a different name for every pay phone in town for her to call back.
Video Games
Tell the manager of the arcade or 7-Eleven or whatever that their video game 
stole your quarter(s). Sometimes they'll give you a quarter, no questions asked 
and sometimes they'll want to put the quarter in themselves to make sure you're 
not pulling a fast one on them. Either way, you win.
If you REALLY need the money or you're just hard up to play the New Super- 
Advanced Mega Ultra Street Fighter VII Classic, you could squirt a bunch of 
super glue into the coin slot so when they tried to put money in it wouldn't 
work and they'd be sure to give you your money back. Sure, the store would have 
to spend hundreds of dollars fixing the machine but, hey, you got a quarter, 
didn't you?
This also works with soda machines, snack machines, pay phones, etc. In a lot of 
colleges they have those snack machines that carry food items that cost $2.25 or 
more! You can go to the nearest college book store or maybe the cashier in the 
cafeteria and they'll give you a refund or mail you a check for that amount.
Shoplifting
What can I say? It's shoplifting, we've all done it. You can do it either for 
the free merchandise or for the money. If you shoplift a $20 shirt you can bring 
it back later and get a $20 cash refund. Usually they want a driver's license 
and sometimes (although it's rare) they'll only give you a store credit slip.
Actual shoplifting isn't always neccessary, though. In a busy store you can take 
something off the shelf and bring it directly to the customer service desk for 
your refund. Here's a few tips for idiot shoplifters:
Right before you shove the item in your purse or jacket, look EVERYWHERE for 
cameras and employees. Remember that if you can see them, they will usually see 
you. It's better for them to see you looking around suspiciously than for them 
to see you steal something because you didn't look around. 
Steal things that they wouldn't expect you to steal. If you bother to notice, 
the cameras are mostly located over the front cash registers, over the 
electronics (Never steal from electronics!), jewlry and make-up because those 
are the things people are always taking. Take things like men's clothing, bed 
sheets, curtians, bathroom supplies, tools, anything that doesn't have a camera 
hovering above your head. 
Use the buddy system! Let's say you want to steal a bed sheet that's $35.00 but 
there's a camera over you WATCHING. Have your friend hold up a blanket or towel, 
pretending to admire it or show it to you while hiding you from the camera's 
view. While the blanket is up, steal the sheet. 
Due to all of the refund fraud (I actually know a couple of female that 
literally made a living off of K-Mart fraud), a lot of stores won't give you 
cash anymore if the refund is over ten bucks and you don't have a reciept. 
Instead, they'll mail you a check or a money order for the amount of the refund 
which is just as good as cash, you just have to wait a couple weeks to get it. 
K-Mart just started doing this a few months ago.
Vending Machines
You can trick a Pepsi machine into think that you're putting in dollar after 
dollar so you'll get every soda in the machine. Use a squirt bottle (like a 
Windex bottle or something similar) and fill it about 2/3 with water. The other 
third should be filled with salt. Find a secluded Pepsi or Coke machine and 
squirt the entire bottle into the dollar bill slot.
After a certian amount of salt water is poured in there, you'll be able to push 
the buttons to get sodas one after the other until the machine is totally 
emptied out. I usually take everything except for the diet soda. Diet soda 
sucks. I've only done this now three times but it's worked every time. Try not 
to leave any finger prints just in case they decide to investigate.
It seems to me that if you're putting in a constant flow of dollar bills into 
the machine for a 55 cent soda you'd get 45 cents back for every one you stole 
but for some reason you don't get any money, just the soda. Who am I to try and 
understand the physics of soda machines. This would probably work on snack 
machines with dollar bill slots too, although I've never tried. It's hard to 
find a secluded snack machine. Who's knows, maybe even dollar bill changer 
machines will work.
Anyways, you can either save these sodas, give them to friends or sell them to 
the tourists on a hot summer day. Imagine sitting next to a soda machine in 
front of K-Mart that sells sodas for .55 cents each. You could sit there with an 
ice chest full of them and sell them at .40 cents each or something. A few hours 
of that could probably get you a hefty profit, not to mention a short- term jail 
sentence.
I was told by a friend that you can take sulferic acid and pour it into the coin 
slot on a soda machine using a piece of paper to funnel it in. I've never tried 
this or seen it done, but it could work. (Wouldn't acid eat through the paper, 
though?) Chlorox or some other kind of bleach can be used as a sub for sulfuric 
acid.
   
