A recording setup on a Verizon payphone. (Image Credit: Author)
An earlier version of this article appears in two parts in 2600: The Hacker Quarterly—Volume 41, Number 2 (Summer 2024) and Volume 41, Number 4 (Winter 2024-2025).
This article is for educational purposes only and is not to be construed as advice or instructions. All attempts have been made to provide the most accurate information at the time of this writing. However, the reliability of this information is not guaranteed. Any unlawful actions taken by the author depicted in this writing occurred more than ten years ago. The author does not condone or encourage any illegal activities, such as telecommunications fraud. Any actions inspired by the information in this article are taken at the reader's own risk. The author takes no responsibility for any damages or legal consequences that may result from such actions.
Note: Most terminology and other technical details are explained for readers who are new to phone phreaking, but feel free to skip anything with which you are already familiar.
Red boxing was more relevant than most people believed after AT&T stopped handling coin calls in the early 2000s, which was addressed in detail in my article “Red Boxing Revealed for the New Age” (2600: The Hacker Quarterly, Volume 23, Number 4). Today, however, it’s obsolete, but there’s still another way to circumvent coin prompts that I discovered around that time, which a relatively small group of phone phreaks have known about for years. I can sum it up in two words: payphone extenders. Instead of playing tones into the phone, we’ll take a look at identifying tones from the phone.
The payphone industry is on its last legs. It took a big hit in March of 2020 when, according to two of its employees, Legacy Long Distance International, Inc. stopped offering its services outside of the corrections industry. Shortly afterwards, most of the payphones in New York City, provided by CityBridge, LLC (CityBridge), were removed by city workers. More recently, Frontier Communications Parent, Inc. left the payphone business at the end of 2023. Although some of the information in this article may no longer be current, most of it is written in the present tense. This is a long overdue subject that I’ll be covering in detail, mostly for historical purposes, while sharing the story of how I discovered payphone extenders and the events that followed. Strap yourself in and get ready to ph33r—we’re about to get into some payphone phreaking that you’ll never learn about at your nearest telephone museum!
One of the most common types of numbers exploited by phone phreaks dating back to the “Golden Age” of phreaking (60s and 70s) is the extender. Essentially, extenders refer to numbers that drop you on a dial tone or allow calls on another carrier’s network. Just like diverters, Private Branch Exchanges (PBXs), and Direct Inward System Access (DISA) ports (which you can read about in old text files), they are usually used to make free phone calls. Other uses include making calls less traceable (when your calling number is not passed to the called party), dialing into Bulletin Board Systems (BBSs) and Internet Service Providers (ISPs), and wardialing.
The earliest extenders used a combination of inward and outward lines called Wide Area Telecommunications Service (WATS) extenders. You’d call an IN-WATS (800) number, wait for a dial tone, enter an access code (in most cases), dial your destination number, then wait for your call to be routed via an OUT-WATS trunk.
“950 extenders,” as they were called, became the phreaker’s new plaything when they were introduced in the 1980s. As the name implies, these are in the 950 exchange, which gives toll-free, Feature Group B (FGB) access to competitive long-distance networks. During their popularity, they would play a dial tone when called and, like most of their predecessors, required dialing an access code followed by a destination phone number. Text files from that period noted that the call quality was “crystal clear,” making these extenders advantageous for data connections. Essentially, most of these extenders function like calling cards with a PIN, and phone phreaks would often crack them using software and a modem that could detect a dial tone or by dialing all the possible codes manually. Text files archived online have more information, and I highly recommend reading them. Now that you know how these extenders work, let’s go over different payphones.
There are five main categories of payphones, some of which may overlap. The first four fall into two pairs: smart payphones and dumb payphones, which indicate whether or not any firmware is installed; and Customer Owned Coin Operated Telephones (COCOTs) and Local Exchange Carrier (LEC) payphones, which designate ownership. Hybrids, the fifth payphone type, are crossbreeds with both smart and dumb characteristics.
The class of service for the lines on which they operate is important to know as well. You may have heard of Automatic Number Identification (ANI), a service similar to Caller ID that identifies the phone number of an incoming call. A more extensive service, called Flexible Automatic Number Identification (Flex ANI), enhances it by preceding the phone number with a digit pair called Automatic Number Identification Information Integers (ANI II), which identifies the calling party’s phone/line type. The North American Numbering Plan Administrator (NANPA), formerly “Administration,” has a complete list of these digit pair assignments on its website where you can learn more: https://www.nanpa.com/numbering/ani-ii-digits. In most cases, the only II digits you’ll come across for payphone lines are “27,” “70,” and, less commonly, “07.” If you find yourself on a payphone with II “29,” congratulations—you’re in prison! The first three assignments apply to the following payphone types:
This article focuses primarily on smart payphones, the majority of which are COCOTs and are usually given ANI II digits “70” or “07.” They contain smart boards that run firmware to perform various functions such as playing voice prompts, determining rates, verifying coin deposits, controlling the duration of the on- and off-hook status, enabling/disabling the handset’s speaker and microphone, and routing calls. Some LEC payphones, particularly hybrids, also use this smart technology, in which case the ANI II digits will be “27.”
Dumb payphones are simpler than smart payphones because they’re network-controlled rather than firmware-controlled. Coin calls are routed over coin lines provisioned with coin control signaling and, in some cases, sent to the Automated Coin Toll System (ACTS) or a live operator. Most of these phones are LEC payphones. COCOTs can also operate like dumb phones, but these are a rare find if any are active today. In either case, the ANI II digits will be “27.”
COCOTs are private phones that are not owned by an Incumbent Local Exchange Carrier (ILEC) and represent the majority of smart payphones today. COCOTs operating on coin lines are rare to none. Consequently, if you come across one, chances are the ANI II digits are “70” (or less commonly “07”), indicating that coin calls are handled by the phone’s internal circuitry. If you do manage to find one on a coin line, the ANI II digits will instead be “27,” but any firmware that may be installed could interfere with you getting an ACTS prompt (it’s rare, but red boxing a COCOT is possible!). These phones are distinguished by placards affixed to them listing their Payphone Service Providers (PSPs).
LEC payphones, referred to colloquially by phone phreaks as BOCOTs (Bell Owned Coin Operated Telephones), are owned by ILECs and can be smart payphones, dumb payphones, or hybrids. If you can find one, the LEC’s name and logo will be on the instruction card and likely displayed elsewhere around the phone. The majority of these are on coin lines with ANI II digits “27” (a go-to for red boxing), while others, which use a smart board to process coin calls, are on “70” and “07” lines.
Hybrids are smart payphones that are network-controlled and on coin lines, therefore sharing characteristics with dumb phones. Like dumb phones, they use coin control signaling and ACTS, but most functions are handled by smart technology. Since they’re both on coin lines, dumb payphones and hybrids share the Flex ANI digits “27.” Verizon payphones, which I wrote about in my aforementioned red boxing article, are the best example of this smart/dumb payphone duality, most notably the ones that were in New York City. For instance, in Manhattan, a local call cost 25 cents for four minutes on a hybrid, and the entire call would be processed by the installed firmware, including an internal coin prompt. In almost any other location, the rate was 50 cents for unlimited talk time, but you had to insert the coins before dialing, and a ground test would be conducted on the line to verify your payment. To further highlight this difference, you could get the same 50-cent deal on one of the New York hybrids if you bypassed the firmware, such as by dialing 1167 (the same as *67 for Caller ID blocking) before the phone number, causing the same ground test to occur. The relevance of this firmware will become more clear as we get into the topic at hand.
It all started when a friend and I were pondering how Verizon hybrid payphones were routing their long-distance and international coin calls after AT&T, who used to handle them, had completely phased out ACTS by the end of 2002. Considering the toll restrictions on these lines and the smart boards installed in the phones, we came up with two possible theories: they had to be using either toll-free access numbers or Carrier Access Codes (CACs). Determined to find the answer, I grabbed my backpack full of various electronics and ventured off to different payphones, the most important of which was a partially enclosed Verizon phone with the line exposed above it right beneath the light bulb socket. After determining what all of these phones were dialing, it turned out that both theories were correct, and I had discovered the key to making free calls from the majority of smart payphones without the need for a red box. I’ll go into further detail on this process later.
Payphone extenders are toll-free (8YY) numbers programmed in smart payphones for routing domestic (1+) and international (011+) coin calls and are referred to as “access numbers” by the payphone industry. They behave similarly to the extenders I detailed earlier, with some differences depending on the company that provides them. Firmware installed in the phones automates the entire process, dialing the numbers using an internal modem after the coins are inserted to place a call. PSPs, who own and manage pay telephones, subscribe to these access numbers the same way a customer would to a phone company calling card. As of the date when this article was written, most of the telecommunications companies that ever provided these access numbers have gone out of business, stopped offering them to new customers, or discontinued the service altogether. Some examples include Phone1, Inc. (Phone1); Legacy Long Distance International, Inc. (Legacy); Worldwide Telecommunications, Inc. (WTI); WiMacTel, Inc.; Custom Teleconnect, Inc. (CTI); and NetworkIP, LLC. (Mergers, acquisitions, affiliates, and company name changes are not included for simplicity.)
CACs, better known as “dial-arounds,” provide Feature Group D (FGD) access to carriers. They use the format 101-XXXX, where “XXXX” is the four-digit Carrier Identification Code (CIC). For example, AT&T’s CIC is 0288 (0ATT). So, if you want to place a 101-XXXX 1+, 101-XXXX 011+, 101-XXXX 0+, or 101-XXXX 0- call over its network, you dial 101-0288 followed by 1-NPA-NXX-XXXX, 011 + international number, 0-NPA-NXX-XXXX, or 0, respectively. (A complete list of FGD CICs is available on NANPA’s website: https://secure.nanpa.com/public-report/speciality-resources/cic/fgd.) Some smart payphones use CACs instead of extenders, while others simply dial the number you’re calling directly after getting a dial tone. Payphones that are programmed this way are not the main focus of this article, but they can still be relevant.
To explain how payphone extenders work, I first need to go over Automatic Number Identification (ANI) and Dialed Number Identification Service (DNIS). ANI is a telecommunications feature that determines the calling party’s telephone number. In Signaling System 7 (SS7), a set of signaling protocols for the Public Switched Telephone Network (PSTN), there are actually two different types of ANI—more specifically, two parameters in the Initial Address Message (IAM) of the ISDN User Part (ISUP) that are used for setting up calls: Calling Party Number (CPN) and Charge Number (CN). CPN is the ANI most often used for identifying callers and the number from which Caller ID is derived. CN, sometimes referred to in a non-SS7 context as Billing Telephone Number (BTN), is the number that is to be billed, if applicable (when available, its value is usually the same as the CPN, but sometimes varies). To put this in perspective, if you place a call to a number that forwards to another destination, the CPN (along with the Caller ID, if available) sent to the called party is your number, but the CN is the number of the forwarded line, since it can be billed.
You can call an Automatic Number Announcement Circuit (ANAC) to find out what ANI is being sent when placing an outgoing call. Most of these test numbers read back the CPN, but others read CN, Flex ANI, and/or Caller ID. One of the most well-known ANACs is MCI’s 1-800-444-4444, which, unknown to most, reads the Caller ID if it’s available; otherwise, it reads the CN. A more reliable ANAC is MCI’s “ANI Verification System,” which can be reached at 1-800-437-7950; it reads the CPN and CN as “Calling ANI” and “Charge ANI,” respectively. There’s another ANAC set up on the Asterisk PBX that reads the ANI II digits, CPN, and CNAM (Caller ID Name): 1-877-YOU-HACK. The information it reads is subject to change in the future.
DNIS identifies the originally dialed number or trunk of an incoming call. Commonly used by companies with multiple toll-free numbers, the data is usually signaled to a PBX or Interactive Voice Response (IVR) as a four- to ten-digit number. In the payphone industry, ANI is the number of the payphone, and DNIS is the access number (payphone extender). Companies maintain an ANI/DNIS database for security and billing purposes. When the extender receives this data, the ANI—more specifically, the CPN—can be used to verify that the call is coming from a PSP’s payphone before allowing an outgoing call on its platform and to determine which PSP to bill for the call. The DNIS can also be used for billing by companies that assign different access numbers to each PSP, but the ANI is used more often since it identifies the payphone. For perspective, before March 2020, Legacy, unlike most companies, assigned the same 1-866 extender to multiple PSPs, requiring ANI verification. This use of ANI/DNIS is the greatest contrast to the extenders I mentioned earlier. Other differences pertain to various tones and the automated process, which I’ll explain below.
When a customer picks up a smart payphone and dials a number that can be locally rated, the dialed digits are stored in the buffer, and an internal coin prompt is played. After all coins are deposited, a dialing sequence is initiated, which, in this example, is to a toll-free access number. Then the smart board dials the extender using an internal modem and waits for a tone. By the time it answers, it will check its database for the ANI/DNIS (in most cases), then play a tone to signal to the payphone that it’s ready to receive digits—this is usually a DTMF (Dual-Tone Multi-Frequency) or dial tone but can also be one or more other audio frequencies. If the ANI/DNIS is not verified, the extender will likely deny the call or answer with a reorder or busy tone instead. In response to this tone, the payphone will dial, at the very least, the initially dialed phone number (buffered digits) that the customer intended to reach. For some extenders, a PIN is dialed before or after the phone number, sometimes followed by “#” (pound) and/or a short pause. The call is then placed and, in some cases, the extender plays a tone back to the payphone—usually DTMF “C”—when the called party answers (answer supervision).
Let’s take a look at the process, step-by-step, that Verizon hybrid payphones had used for international coin calls. The extenders they used were owned by Phone1, the company with its logo printed on the distinctive yellow handsets that used to be found on many payphones. One of the access numbers I can reveal for this example, since it’s been out of use for many years, is 1-888-852-2546, which had the PIN “3988.” Here’s the automated process from start to finish:
Payphone customer dials international phone number.
Smart board stores the dialed digits in the buffer.
Call is locally rated and coin prompt is played.
Customer deposits coins while payment is verified electronically.
Payphone dials access number (1-888-852-2546) and waits for DTMF “A.”
Access number verifies the ANI it receives, plays DTMF “A,” then waits for a PIN and phone number.
Payphone dials PIN (3988) followed by “#,” then waits for a half second.
Payphone dials 011 + international number (buffered digits), then waits for DTMF “C.”
Access number places the call, then plays DTMF “C” upon answer supervision.
The smart board may perform other functions during this process, such as playing voice prompts and enabling/disabling the handset’s speaker or microphone. Many payphone extenders are simpler than this example because they don’t signal answer supervision with a tone or require a PIN. If a CAC is used to route the call, the payphone will dial that instead, followed by the domestic or international phone number. This process will vary based on different models of smart boards, their programming, and the companies that own and maintain them. From the 2000s to the 2010s, Verizon hybrid payphones used the Gemini System III (GSIII) and older Gemini System II (GSII) chassis, provided at the time by Quortech Solutions, Inc. (QuorTech), formerly Elcotel, Inc., and Technology Service Group, Inc. (TSG) before that. These two smart boards supported payphones on coin lines, and QuorTech had an agreement with Phone1 for routing coin calls over its network. This followed AT&T phasing out its ACTS that handled long-distance and international coin calls—the same system that made red boxing possible to destinations all over the world. Little did the payphone industry realize that this would lead to a new method of making free phone calls on a myriad of upgraded payphones—by dialing the access numbers yourself!
The best way to get payphone extenders involves two steps: recording coin calls and identifying DTMF tones. I’ll go over some alternative methods as well, some of which don’t use hardware or software!
Continuing from where I left off in my story (under “What Are Payphone Extenders?”), I was trying to figure out what Verizon hybrids were dialing by listening from the handset, but most of the audio was filtered out by the smart board. I needed to bypass the payphone to hear what was happening in the background, so I first went to the partially enclosed Verizon phone with the exposed line, which was a hybrid using a GSIII chassis. I had found it weeks earlier and knew I had to return with my equipment, so I put on my backpack and took the subway to the stop near MIT where it was located. Once I got to the payphone, I took out my cassette recorder (I didn’t have a digital recorder at the time) and telephone line recording adapter with alligator clips attached to the modular plug. With the adapter clipped onto the pair and plugged into the microphone jack on my recorder, I pressed the “record” button and made four coin calls both inside and outside the Local Access and Transport Area (LATA): local, intra-LATA (local/regional) toll, inter-LATA (long-distance), and international. The audio in these line recordings was not filtered out by the smart board, and I couldn’t wait to bring home what I had captured to figure out what the payphone had dialed!
This explains one way to record coin calls. Only long-distance and international calls used an extender, as is the case for most smart payphones. The Verizon hybrid I was using would become disabled if there was a drop in the line voltage from an extension phone (also known as a beige box) going off-hook, but you could get around this by using a line recording adapter or the monitor mode feature on a lineman’s handset. Also, the GSIII chassis filtered out the DTMF going to the payphone’s handset, but the older GSII played them clearly in short bursts. These tones can also be heard faintly from the handsets of most COCOTs to this day! Since payphone lines are usually inaccessible, it’s best to record the audio from the handset’s earpiece by using an induction pickup coil plugged into your recorder, ideally one with a suction cup. Additionally, using a recorder that saves audio files in common digital formats is best for the next step since the quality is better and you can transfer the files to your computer.
Once you’ve found a payphone to record, hold your pickup coil against the earpiece or some place near it to pick up the sound. If it has a suction cup, you can use that to secure it in place, but tape, a rubber band, or mounting putty will suffice. To avoid recording external noise, you should also cover the mouthpiece with putty, sheet rubber, an acoustic coupler, or the palm of your hand. If your recorder lets you monitor what you’re recording, plug in your headphones and listen to everything in real time; this will help you pick up quality sound and avoid or minimize unwanted electromagnetic interference (EMI). Once the audio sounds clear, try recording the aforementioned coin calls. If you want your change back, dial a non-supervising (no answer) number, or hang up before the call connects. When you’re finished, listen to your recording(s) carefully with headphones on, focusing on the clarity of the tones. They’ll probably be low in volume, but they’re the key to knowing what the payphone dialed.
Recognizing touch-tones is an important skill to have in phone phreaking, and this is where it will be put to the test. When a call is being processed, DTMF from the handset is usually very faint and overall poor in quality, making a DTMF decoder unreliable. This makes identifying the recorded tones by ear the best option. Accordingly, I’ll focus on how to do that with the aid of an audio editor like Audacity. If your digital recorder doesn’t save audio files, you’ll first have to convert your recording(s) to an acceptable format. Once you have digital files, load them into your audio editing software. If possible, choose the Waveform and Spectrogram views together (Multi-view in Audacity); this will help you see tones that are low in volume and give you two visuals to compare. You won’t be able to discern faint tones well, if at all, in Waveform view, but Spectrogram view will display them based on their frequencies between 697 and 1633 Hz for DTMF.
Screenshot of an audio file in Multi-view in Audacity. (Image Credit: Author)
You need to focus more with your ears, however, so listen carefully to the audio and locate the tones, particularly the ones following coin deposit. Then remove everything else to make your task easier. Highlight each section of the waveform to play the individual tones, then play each DTMF tone from another source, such as a tone dialer or DTMF-generating program, to compare until you hear the matching tone. It helps to play the unidentified tone on a loop while doing this; when you play the DTMF tone that matches, the frequencies from each source will be close together, but not perfectly in tune, causing an interference pattern and beat frequencies. Beats are heard as an oscillation in loudness, often described as a “wah-wah-wah” sound, and should oscillate at the slowest rate for the correct DTMF digit. It often helps to play each frequency in the DTMF matrix until you find the two that produce the same effect, such as 852 and 1336 Hz for the “8” key. If you’re using a tone dialer, you can try pressing two or more of the keys in a single row or column, and it may play the frequency that they share depending on the circuitry.
You can do frequency analysis in the spectrogram as well. The DTMF frequency pairs, displayed above and below each other, should roughly align with the correct frequencies displayed on the side. Depending on the selection tools available, you should be able to click and drag to select each tone and view its peak frequencies, which are likely to be close to the correct ones. For example, 709 and 1227 Hz would approximate to 697 and 1209 Hz, respectively, indicating DTMF digit “1.” There are other tools you can apply to increase the clarity of the audio, including amplification and noise removal. The more you familiarize yourself with DTMF and audio editing software, the better you’ll get at figuring out payphone extenders and PINs.
Although DTMF decoders are unreliable for low-quality handset recordings, there are cases when the tones are clear enough to use one, such as Verizon payphones with the older GSII chassis. Simply play the recorded tones into your decoder’s audio input/mic. If you don’t have one, you can try playing them over the phone while connected to an IVR or another automated system that reads the digits back to you. You’ll get the best results by connecting one directly to a payphone line, which was my original plan for the Verizon hybrid near MIT. If your DTMF decoder is designed for this, you can simply attach the phone cord to the exposed pair using alligator clips or plug directly into the phone jack if one is available. If it accepts only an aux/mic input, or if you’re running DTMF decoding software and need an audio feed into your sound card, you’ll have to use a line recording adapter. Once everything is connected, activate your decoder, place the coin calls that I mentioned earlier, and the DTMF digits will be displayed on the screen!
Most smart payphones use a feature called “Trickle Dial(ing)” to prevent the line from timing out while the customer dials a phone number and deposits coins. When enabled, most of the DTMF digits to place the call are slowly “trickled” down the line, usually all but the last one, and they’re likely the digits of an extender if the payphone uses one. You can use a recorder or DTMF decoder, but since these tones are dialed slowly, you can simply listen to them from the handset and identify them by ear without the need for any equipment!
To begin, pick up the handset and slowly start dialing a long-distance or international number. As you do this, you’ll hear the trickle dialing in the background, and you can take note of each DTMF digit that you recognize until you have most of the number. You can dial what you think is the correct digit after each tone for comparison, but don’t dial too quickly. Once you dial a complete telephone number, you’ll get a coin prompt, and it’ll be more difficult to hear the rest of the trickled digits. Don’t take too long either, or it will time out and you’ll have to start over again. The trick is to dial as few digits as possible to maintain the trickle dialing stage.
You may be able to dial more digits and prolong this stage even further depending on the payphone’s programming. Try dialing a “*” (star) somewhere after the first digit or two to prevent the smart board from recognizing that a complete phone number was dialed. If you don’t hear an error message, you should be able to dial more digits without the coin prompt coming on. The trickle dialing is also more likely to repeat in this case, where the payphone gets a new dial tone and starts over before reaching the end of the phone number. One possible drawback to this method is that you won’t get a PIN, though most payphone extenders don’t use one anyway. Assuming the payphone dials all but the last digit, you’ll have up to only ten phone numbers to scan to find the extender, which you’ll recognize from the tone it plays.
If you’re on a payphone that can receive calls, you may be able to get any extenders it uses from another phone. Some telephone switches hold the line open for a longer period of time after you hang up if you’re on an incoming call. If this is the case, you can trick the payphone into thinking you’re placing a new call and identify the DTMF tones from the other end of the line! Start by calling the payphone from another phone that has a recorder or DTMF decoder hooked up, or have another person do the same. Answer the call, then quickly press and release the switch hook. If the switch holds the line open, you’ll still be on the call and likely won’t hear a new dial tone (unless the payphone generates its own). However, the firmware will think you hung up and wait for you to place a call. While the recorder or DTMF decoder is active on the other phone, dial a long-distance or international number and deposit the coins when the prompt comes on. At this point, as long as the smart board doesn’t get a new dial tone, it will dial the extender with the called party still on the line, and the DTMF will be recorded or decoded!
If there’s a PIN and the smart board doesn’t dial it, you can try mimicking the extender’s behavior by playing its tone (e.g., DTMF or dial tone) from the other phone after the payphone dials the access number. The smart board should respond by dialing the PIN along with the phone number stored in the buffer. If you don’t know what tone the extender uses, you can try to identify it from the payphone by using the methods detailed earlier in this section or by playing the most common tones, such as DTMF “A,” “*,” or dial tone (350 and 440 Hz). You can also use a software PBX to emulate the extender by setting one up to call the payphone, play any necessary tones, and record/decode the DTMF. The explanation of the automated process from the earlier section “How Payphone Extenders Work” can be used as a reference.
Once you have a payphone extender, you can scan around the number to try and find others. Many years ago, there was a small PSP in my area that used a 1-866 access number that ended in “2412” on many of its payphones. When I called the numbers in the same exchange between “2413” and “2419,” I found many more! You can try doing the same thing with other extenders by sequentially dialing the numbers before and after them. It’s best to do this from one of the payphones that uses the access number you’re scanning around so the ANI can be authenticated; otherwise, any extenders you call may not respond with a tone that you will recognize.
Getting back to my story, after I brought my recordings home from the Verizon payphone and identified the tones, I ended up with two extenders: one for domestic calls and one for international. In an earlier section, I mentioned the international extender along with its PIN. Additional extenders were used by payphones in other Verizon territories. Conversely, the one for domestic calls had no PIN and worked on all Verizon payphones in the US! That number was 1-800-713-6496 and, like the international extender, it played an “A” tone. Placing a call was as simple as dialing a telephone number after that tone, as long as it recognized the ANI. This is similar to the PINless dialing feature on some prepaid phone cards where you can assign the number you’re calling from to be recognized to bypass the PIN. It’s a nice convenience—what could possibly go wrong?
To use an extender, all you have to do is dial the phone number in the same dialing format that the payphone uses, which you’ll figure out when you identify all those tones. If there’s no PIN, you can also figure it out by attempting three calls in different dialing formats: two domestic and one international. First, try dialing an area code and phone number with and without a preceding “1” in the formats NPA-NXX-XXXX and 1-NPA-NXX-XXXX; then, try dialing 011 followed by an international number. You will know which formats and types of calls are accepted based on the ones that go through.
If none of those attempts succeed, the extender has a PIN, which you can obviously get using some of the methods I detailed earlier. Payphones will usually dial the PIN—with or without “#” at the end—before or after the destination phone number. If you already know the PIN, you can try dialing that and the phone number in all the possible formats to figure out which ones can be used to place calls.
If a payphone uses a CAC, you’ll have to use a beige box on the line or find a way around the firmware if you want to place a call with it. This is because the firmware restricts 101-XXXX 1+ and 101-XXXX 011+ calls. There are a number of ways to get around restrictions programmed in smart boards; some of them work on extenders, CACs, or both. Let’s get into them.
Weeks after I got the extenders from that Verizon payphone, none other than the late, prominent hacker Kevin Mitnick left me a voicemail. I recognized his voice immediately. He said a mutual friend gave him my number, and he wanted to speak with me, asking me to call him back on his cell phone. We started playing phone tag, and in one of his follow-up messages, he said that he had Verizon’s access number for domestic calls but was also interested in the international extender. I had shared the former with a few select friends, and word sure spread like wildfire! When I finally reached him on the phone, we talked for a little while, and I gave him the number and PIN. A few weeks later, I dialed one of the extenders on a Verizon payphone, but instead of the call going through, it played a new voice prompt: “restricted number.” It turned out that new security measures had been added to the firmware for all Verizon hybrids to prevent users from dialing the extenders, and the timing was awfully suspicious!
This prompted me to figure out various ways to circumvent the restrictions, some of which involve bypassing the firmware altogether. Payphones and their firmware will vary, and therefore so will your results if you try these methods. The types of smart payphones that each method works on—COCOTs and hybrids—are pointed out below. If a CAC can be used, that will be indicated as well.
If dialing a payphone’s extender has been restricted, you can skip the “1” at the beginning and dial the rest of the toll-free number in the format 8YY-NXX-XXXX. If this format is accepted, the payphone will dial the access number in the correct format (1-8YY-NXX-XXXX) to place your call. This method only works on COCOTs.
You can try dialing “0” in place of “1” at the beginning in the format 0-8YY-NXX-XXXX. If this format is accepted, the payphone will dial the extender in the correct format (1-8YY-NXX-XXXX) to place your call. This method only works on COCOTs.
A payphone with badly programmed firmware may process what it thinks is a free call if you dial only three to seven digits. This allows you to get around dialing restrictions on extenders and CACs and to make free calls directly to intra-LATA numbers! To test this method, pick up the phone and dial the first three digits of a phone number or CAC, then wait to see what happens. If it works, the payphone will dial those digits and then unmute the handset’s mouthpiece, at which point you can dial the rest of the digits yourself. If you get an error, you can keep trying with more digits until you eventually reach seven, noting all successful attempts. If you’re dialing the beginning digits of an intra-LATA number that is outside the local calling area, be sure to dial a “1” first. This method works only on COCOTs.
This is an old method of making free calls on payphones that bypasses the firmware. During a call, if you let the other party disconnect on you, the payphone may give you a new dial tone without any restrictions, allowing you to dial a payphone extender, CAC, intra-LATA number, etc. without any interference from the firmware. To begin, make a free call that the payphone allows, such as to a toll-free number, operator, Telecommunications Relay Service (TRS), or speed dial code (*X or *XX code). When the called party, whether it’s a human or an automated system, answers, you can remain silent and wait until the call ends or take the necessary action(s) to get him/her/it to hang up on you. Once the called party disconnects, listen for a new dial tone. If you hear one, start dialing to place your call. Some payphones will disable the keypad at this point, in which case you’ll have to use a tone dialer or other DTMF device.
If that fails, you can try again by calling the payphone from another phone, if it accepts incoming calls, or having another person or automated system do it. Then you can answer the payphone and wait for a dial tone again after the calling party disconnects. This method works on COCOTs and hybrids.
Vertical Service Code (VSC) is a NANPA term for the “star codes” that access telephone features called (Custom) Local Area Signaling Services (CLASS or LASS). It’s usually preceded by “*,” but “11” is also accepted due to rotary phones. If it’s provisioned on the payphone line, you can use the VSCs for blocking and unblocking Caller ID—*67 and *82, respectively—to circumvent dialing restrictions, including on payphone extenders and CACs. The DTMF for “*” is likely filtered out by the smart board, but you can try dialing 1167 or 1182, which will hopefully be an unrestricted sequence of digits. If you hear a stutter dial tone, you can finish dialing to place your call without any firmware interference. This method works only on hybrids.
If you’re using a payphone that allows any of the DTMF to pass through while dialing, quickly tapping one of the keys can trick the firmware into thinking you dialed that additional digit on the line. It’s best to do this at the beginning, so start out by picking up the payphone and quickly tapping “1.” If you still hear a dial tone, you can dial a payphone extender, CAC, etc. without firmware interference. This works because the smart board recognizes the “1” key, but the tone it generates is too short to be detected at the Central Office. If you’re calling a payphone extender, for example, the smart board will think you’re dialing 1-1-8YY-NXX-XXXX, which should not be restricted. If tapping “1” breaks the dial tone, hang up and try again. This method works only on hybrids.
Repeatedly tapping one of the keys on a payphone can prevent the DTMF from the smart board’s modem from reaching the line while a call is being processed, and you can take advantage of this to get unrestricted access to the dial tone. For this to work, place a free call that causes the smart board to get a new dial tone, then dial all of the digits from the beginning, rather than continuing from the trickled digits. On Verizon hybrids, this worked after dialing “0,” which triggered a dial string or dialing macro to use a dial-around in the 101-XXXX-0 format to route the call to a long-distance operator, so try dialing that first. If you take no further action, you should soon hear dialing in the background, likely preceded by a voice prompt such as “thank you” or “please wait.” Listen carefully to the free call being processed and get familiar with it, particularly when the dialing begins and ends, which will help you with the next step.
When you’re ready, place the free call again. Rapidly tap one of the keys just before the modem starts dialing (“*,” “0,” and “#” are the most likely to work), then stop just after it’s done. If your timing is right, you should hear the dial tone, at which point you can dial any sequence of digits, including a payphone extender or CAC, without firmware interference. If your timing is too short or too long, DTMF from the modem or the key you were tapping may have broken the dial tone, in which case you can keep trying until you get it right. You can also try different types of free calls to see if you get better results.
It’s easy to understand how this works. You get the dial tone due to none of the modem’s DTMF being able to reach the line, and dialing is unrestricted because the firmware thinks the free call has been completed. This method works only on hybrids.
You can play DTMF into the handset’s mouthpiece to get around dialing restrictions as long as it isn’t muted by the payphone when you go off-hook. However, the GSIII chassis, which is likely installed in such a payphone, can prevent some or all of the DTMF from reaching the line and, according to its 1998 product manual, has a feature called “Pocket Dialer Detection,” which detects DTMF from the handset and “processes the information as if the DTMF came from the dial.” Nevertheless, you can either take advantage of this feature or bypass the tone detection to get around firmware restrictions, such as on payphone extenders and CACs.
To bypass tone detection, play a constant DTMF tone before you go off-hook, stopping after the dial tone comes on. If you do this while holding your tone dialer or other DTMF device over the mouthpiece, it will be undetected by the smart board but still signal the Central Office, thus breaking the dial tone. If there are any additional digits to dial, you can do so from the handset or the keypad, and your call should go through without firmware interference since the smart board never detected the first digit. For example, if you want to call a payphone extender, play a constant “1” tone into the mouthpiece until the dial tone comes on, then dial the last ten digits—the only ones the smart board will detect—normally, in the format 8YY-NXX-XXXX.
Playing DTMF can have the opposite effect if it’s at a lower volume. If you play a tone that is low enough to avoid signaling the Central Office, but still loud enough to be detected by the smart board, it will trick the firmware into thinking you dialed that additional digit on the line. To begin, pick up the handset and hold your tone dialer or other DTMF device at a short distance from the mouthpiece (or up close with the volume lowered if that option is available), then play a “1” tone. If the dial tone is still playing, dial the sequence of digits normally, either from the handset or keypad, to see if your call goes through without firmware interference. If it did, the smart board detected that first tone; otherwise, you’ll need to try again with your DTMF dialer set closer to the mouthpiece or at a higher volume. Should the dial tone break following the “1” tone, hang up and try again with your dialer set further away or at a lower volume. For example, if you want to call a payphone extender, play a “1” tone into the mouthpiece at a lower volume, then regularly dial all eleven digits in the format 1-8YY-NXX-XXXX, resulting in the smart board detecting 1-1-8YY-NXX-XXXX. This method works only on hybrids.
Diverting calls to another number sometimes results in the calling party’s ANI—usually just the CPN—being sent to the called party. This is often the case when calls are forwarded or go over a toll-free extender or calling card platform. If you have access to something with a toll-free number that can divert your calls, you can use it to call a payphone extender since it’s a separate number that is not restricted in the payphone’s firmware. Just make sure it passes the payphone’s CPN (you can check with an ANAC), or it likely won’t work. This method works on COCOTs and hybrids.
In some cases, you can dial a different access number than the one a payphone uses, which is unlikely to be restricted in the firmware. It still might let you place calls, even if the extender is provided by a different company or used by another PSP. This is likely due to ANI/DNIS databases not getting updated as payphones are replaced or go under new ownership with the same phone numbers, as well as single companies verifying the same ANIs across multiple access numbers. For example, I mentioned a small PSP earlier that had many access numbers that could be found by scanning; they all worked on that company’s payphones and were provided by the same telecommunications company. You could also use some of those extenders on many Verizon payphones, which probably had the same ANIs as previous payphones installed in those areas. This method works on COCOTs and hybrids.
If a payphone’s line is exposed, you can bypass the firmware altogether by hooking up your beige box. Although you can dial anything freely from there, since payphone lines tend to have toll restrictions, you’ll likely have to use a payphone extender or CAC. This method works on COCOTs and hybrids.
Now for the best part: you can spoof the ANI of a payphone to an extender to make free calls from anywhere! ANI/Caller ID spoofing has been possible for decades, from the early days of social engineering operators to using VoiceXML applications to the now-popular use of VoIP and software PBXs. Regardless of the spoofing method, you specifically need to spoof the CPN for this to work, which is usually the type of ANI that is sent on such a call anyway. Once the extender answers with a tone, you can dial the number like you’re at the payphone, and there’s no firmware to get in your way!
You’ll need to find a payphone number to spoof, which can be difficult today. If you come across a payphone, you can find the number displayed somewhere on the front or dial an ANAC to have it read the number back to you. If you can’t find a payphone, you’ll have to find the number for one online. You’ll get a lot of results from search engines and social media, but there are current and former payphone lists, including Payphone Project (https://www.payphone-project.com/), Pay Phone Directory (https://www.payphone-directory.org/), and YAPL: Yet Another Payphone List (https://web.archive.org/web/20090720023132/http://www.yapl.org/). Unbeknownst to the maintainers of these websites, they’ve enabled free phone calls to be made for years, and the numbers are archived on the Wayback Machine!
You may be thinking that a lot of payphones have been decommissioned and that the numbers that had been assigned to them can no longer be spoofed to extenders. However, the ANI/DNIS databases are usually not updated whenever payphones go out of service, allowing you to spoof old ANIs and still place calls! Whether you find an old number online or displayed on a defunct payphone, it helps to know the PSP with which the number was associated, which in turn can help you determine which extender(s) to use. For example, CityBridge used the same 1-800 extender on all of its payphones in New York City, but many of them were defective, with the number (and company name) still displayed on them. If you knew the PSP was CityBridge and the access number that had been used, you could’ve spoofed one of those old numbers to the 1-800 extender and likely made a free call.
Anti-spoofing measures, such as STIR/SHAKEN and call analytics, have made ANI/Caller ID spoofing more difficult in recent years. The epidemic of robocalls has made this a high priority, and the battle against these types of calls is likely to continue for many years. That said, it’s still possible to spoof to many toll-free numbers, and that presumably includes payphone extenders. Time will tell how long it will take for that to change.
Payphone extenders will soon become a thing of the past, likely because the service is becoming unprofitable as payphones continue to dwindle in numbers. However, I’m glad I was able to share this fragment of phone phreaking history with you before that happens.
Shouts: I-baLL; symb01ic; av1d; Lucky225; greyarea; licutis; Doug from Doug TV; WhiteSword; Natas; Enamon; vvn; accident; elf; nes; XlogicX; Murd0c; Rucas; Lowtec; TheKid; agent5; ntheory; LamerJoe; gr3p; dropc0de; handler; micro214; Digi-D; Jolly; ic0n; bagel; Cessna; deceit. Additional shouts: the old SoCal bridge; BinRev forums; Phone Losers of America (PLA); Bell's Mind (PBX); Telephreak; Boston 2600 (the old and new meetings). R.I.P. KRT_. You will never be forgotten.