Defeating *67 With Omnipoint

by TtJ

Ever since Caller ID came into existence, the question of how *67 blocks the calling number from appearing on the Caller ID box has been asked by many people.

A lot of us were not sure if the Caller ID data delivered by a *67 call contained only the "PRIVATE" message or if the calling number was in fact sent along and simply not displayed.  The answer, as some of you might already know, is definitely the latter!

Assuming that Caller ID is available in your area and someone calls you using *67 in order to remain anonymous, his or her number will still reach your phone switch and, with the right access, you can find out what that number is.

This article is not written from a technical perspective, therefore it will not talk about how to manipulate the actual Caller ID data.  Instead I will describe how Omnipoint voice mail can make *67 completely useless.

Omnipoint is a company that provides GSM phone service in the Northeastern region of the United States.  Besides making and receiving calls, Omnipoint offers a variety of very useful features.  One of these features is voice mail.

When using message playback on the voice mail, the caller's originating number is announced prior to the message.  A rather interesting thing is that this voice mail system will obtain the caller's number even if the caller uses a Caller ID block, namely *67, 1167, or All-Call Blocking.

This has led some people to believe that Omnipoint voice mail uses ANI technology.  However, this is not true at all.  The system obtains the originating number using Caller ID information and it bypasses Caller ID block either because of a "bug" in the system or because of the way the system reads the Caller ID data.

To verify that the technology used here is indeed Caller ID and not ANI, a very simple test is conducted:

1.)  Use two telephone lines: Line A and Line B.

2.)  Call Forward Line A to the Omnipoint voice mail.

3.)  Call Line A using Line B.  You'll be connected to the Omnipoint voice mail since Line A is forwarded to it.  Leave a message on the voice mail.

4.)  Call the voice mail and retrieve the message.

If the system read back Line A's number, we would know that ANI was the technology used.

However, in this case, Omnipoint voice mail will read you back Line B.  This indicates that the system gets the telephone number from Caller ID data because when using Call Forwarding, the switch will always deliver the Caller ID info of the party that initiated the call (of course this is assuming that all the switches involved have Caller ID capability).

The reason why it is very important to point out that this voice mail detects numbers through Caller ID and not ANI is because it makes the system so much more powerful and a lot scarier.  If the system used ANI, the only way that it could obtain the caller's number would be if the caller dialed the actual Omnipoint number.

Thus, theoretically, the caller could first find out if the number he or she is about to call is in an Omnipoint exchange and then take appropriate precautions when calling this number (just like when calling 700, 800 and 900 numbers).

However, since the Omnipoint switch reads Caller ID and ignores *67, any phone line can be forwarded to the voice mail making it impossible for the caller to know beforehand what he or she is getting into.  I have no idea if the GSM systems in the rest of the country do the same thing.

Considering that Caller ID now works on an interstate level, people from anywhere else in the country can still forward their phone to any Omnipoint number in the Northeast.  They can then get the anonymous caller's number by simply accessing the voice mail.

Just remember, if there is a number you want to call anonymously do not by any means rely on *67 to block your number.