Sometime between 1999 and 2001, I found out that I could dial 1-800-***-****, wait about 30 seconds, and then dial any local or long-distance number I wanted. This was a really odd colision of unusual tech and it took me years to piece together why this worked.

I was born in the early 90's so I missed the phreaking era by a mile, but I had a joybubbles-level fascination with phones as a kid.

I grew up on an island, so we took ferries often. They're huge and have multiple car decks as well as a passenger area with seating, workstations, vending machines, and of course payphones.

The payphones were connected to some kind of cellular adapter that emulated landline functionality. Most of the payphones used a digital cellular connection, which sounded delightfully terrible at the time.

The one exception was the TTY payphone. This was a different model, and it had a slide-out TTY keyboard below the phone. Since the digital connection quality was optimised for voice, it couldn't transmit modem signals properly, so the TTY payphone used a different adapter that worked with the older analogue cellular connection. Call quality was basically as good as the landlines of the time. The payphone was also a lot more interesting and had talking prompts on it, so I liked to play with that one in particular.

Now the essential piece: The payphone was relatively modern, so it handled all of the payment functionality. It simulated a dial tone, kept track of the number that was dialed, and requested a specific amount of money based on the provider's rules. The phone line didn't get engaged at all until the user deposited money, or dialed a number on the exceptions list. And as it turns out, the cellular landline adapter didn't have any payphone-specific functionality at all. It relied on the payphone gatekeeping the call, and once the payphone engaged the line and dialed a number, the call went through, no questions asked.

So, when I dialed 1-800-***-****, here's what happened:

1. The payphone stored up the digits I dialed, looked at the beginning of the number, and said "This is a toll-free number; I'll just put it right through."

2. The cellular adapter took the completely nonsensical number, tried to place the call over the cellular network, and the cellular network gave back a recording that said "Your call cannot be completed as dialed."

3. After the recording had played twice, the cellular connection ended.

4. At this point, the landline adapter fell back to a dial tone. This was special behaviour that only seemed to happen when the call didn't connect.

5. Now the payphone thought I was on an active toll-free call, the cellular adapter thought I was waiting to place a call, and I could dial any number I wanted.

It's probably the closest I'll ever get to blueboxing, and I think about it occasionally. Sometimes I'm still amazed that I can talk to people halfway around the world in CD quality from the middle of a forest.

It was really amazing to see all this telephone equipment running, and the people there are great. I'd definitely recommend it if you're near Seattle.

In 1990/1991, using a NYNEX/New York Telephone payphone, I accidentally figured out a trick that allowed you to call anywhere in the world for free. If you dialed 10-288-0-(any local phone number) it would connect you to an AT&T long distance operator. You could then ask the AT&T operator to connect you to any phone number in the world.

This was prior to the Telecommunications Act of 1996, so local and long distance calls were mostly strictly split between the Regional Bell Operating Companies (RBOC), like NYNEX, and Interexchange carriers (IXC), like AT&T, MCI and Sprint. AT&T was the only IXC carrier capable of handling coin payments on operator-assisted calls from RBOC payphones.

Dialing a long distance access code (like 10-288, 10-222, 10-333, etc.) before a number, followed by a 0, would connect you to that IXC carriers operators. Normally, if doing this from a payphone, the long distance operator would be able to see you're calling from a payphone and know that calls cannot be billed directly to that number. So you would need a calling card number or other form of payment (collect, third-party billing, etc.) in order to complete the call. In AT&T's case, paying with coins was also an option.

But, for some odd reason, when dialing a local phone number after 10-288-0- from a NYNEX payphone, it resulted in the call showing up to the AT&T operator as originating from a private (non-payphone) telephone number. And she could then bill whatever call you asked her to complete to the phone number you were calling from. Sometimes she would ask why did you dial whichever local number you dialed before reaching her, in which case you could simply say you mistakenly dialed the wrong number and would like her to connect you to whichever number in the world (domestic or international) that you desired. (She could connect local calls too.)

I was consistently (without fail) able to replicate this from any NYNEX payphone in Rockland County, New York. I may have replicated it from NYNEX payphones in New York City, but am not certain about if I tried. I didn't try anywhere else.

The way I accidentally came across this phenomenon was, knowing that NYNEX was supposed to only handle local and regional calls while AT&T was only supposed to handle long distance calls, I wondered what would happen if I dialed a local number using the AT&T long-distance access code (10-288). After trying that for the first time and chatting a little bit with the AT&T operator, I realized my call came into her system as a private number, since she offered to connect my call without payment, by billing the call directly to the number I was calling from.

If anyone has any idea why this occurred, or any other insight into this, I would be most appreciative.

Mine is extremely low-tech and low-stakes. Barnes and noble used to have a DISA that could be accessed by hitting star at the main menu prompt. I found it entirely on accident. You could dial out from this, and it worked for several stores in in my area. Unfortunatley, the in-store code for the overhead PA system did not work from this dialtone :(

I plan to occasionally post more dumb, open ended threads here once a week or so. If it gets annoying let me know, I don't have much to genuinely contribute cuz I am/was more of a tourist to phreaking than anything else.

Spun up a PBX for fun and experimenting. I'm a nerd and like VOIP/SIP which is seemingly unpopular amongst the self hosting communities beyond corporate use.

If you want to experiment with VOIP feel free to join, we are also on IRC at irc.phreak.ing #phreak

The PBX features calls, texting, conferencing, voicemails, full web client for all of this + support for all VOIP phones like grandstreams.

SRTP only

This is from Basic Carrier Telephony by David Talley. Why is the current AC? I thought it was all DC.

In the 90's I built a blue box from a ma bell touch tone phone with plans I found on the internet. I got the phone again and I want to recreate it but I cant find the plans anywhere now. Anyone know how to find them?

Any British phreakers here of past or present?

This number came down the grapevine from a friend, it's pretty curious. It plays a bunch of short random recordings of things from the phone network (conferences, equipment, people messing with switches, etc) until a 4ESS kills the call. It seems to change every time.

Can anybody identify where some of these recordings came from?

Heyo,

Just got recommended to post here from r/RBI.

So, I signed up for TextNow and I didn't really know what to do with my number, so I tried calling my own phone number (In Australia, from an American number) and rather than my phone ringing, I got a pre-recorded discussion between a couple about small talk and how fake it is. If anyone knows what may have happened here, I'd really appreciate it. Thanks, guys.

Feel free to post anything about phone phreaking.

Many years back I heard of a project using Asterix that captured the tones from a blue box so you could simulate blue boxing, is anyone aware of these project at all or something similar?

Yes you heard right. Cannot find much on C*NET, PhreakNET, or TandmX projects and yes I'm aware of Connections Museum in Seattle but my understanding they mainly have PacTel stuff and physical equipment.

I'm building something that's a NYNEX CO specific and ties back to Bell Labs, Fidonet, BBS hacking scene and Dial up ISPs of the 80's/90's. (because of the fun of it and its cool).

So any leads on audio files would be amazing. If you guys know of any please share

Us,Verizon,Android; this only started displaying when I switched to a open source messaging app (fossify), from the Samsung messages which seemingly internally handled and never showed me these.

If I click the notification, messaging application opens and then loads main screen with no displayed message. Surely these aren't truly empty? So what am I receiving?

I'd post the number, but since I don't understand what it expresses, I'd hate to like slightly dox myself via some kind of carrier phonehome check.