Screwing With Moviefone
by thirdhorse
Moviefone (MOFN) is a publicly traded company that lets you purchase movie tickets with your credit card via the phone or their web page. Known as 333-FILM in the Boston area and 777-FILM in New York it is available in 30 major cities and serves 12,000 screens.
Moviefone has ATMs in the lobby of all theaters it services. Each ATM has its own CPU, screen, printer, and card reader. They come with a test card which when slipped in and pulled out produces a ticket that says "TEST" on it and nothing else. The ATMs use a Local Area Network (LAN) to connect to the theater's management computers.
Moviefone has many uses beyond simply buying tickets.
One of the most obvious is getting into "R" rated movies if you are underaged. Buy the tickets via Moviefone and no box office person will ID you.
Moviefone used to accept any expiration date so you could use a generated credit card number, but nowadays it requires the proper expiration date. This can be helpful if you find a number somewhere but no expiration date. Simply hack it out via Moviefone by advancing month by month until you get the right one. If you tried something like this on an Long Distance Carrier (LDC), the card would be blocked from making calls through the carrier even with the correct expiration date.
So you got a card number but no card? Moviefone ATMs require the use of the magnetic strip on the card via the card reader and has no options that allow manual input of the card number. However since the ATMs are on the LAN of the theater's computers, tickets for Moviefone can also be picked up at the box office where those terminals do allow manual entry of the card number. All you have to say is, "I left my card at home but I have the number, can I still get my tickets?" One would think that the box office people would be suspicious, but they never are - it happens so often.
This technique can be used by box office cashiers for getting extra cash. Before their shift in the box office or while on break they order tickets using stolen credit card numbers. The four ticket per transaction limit Moviefone has installed is no good as you can call back using the same number to again purchase four more tickets. The employee then punches up those tickets while in the box office and sells them pocketing the cash. It is safer than selling courtesy or discount tickets at full price as Moviefone tickets printed at the box office are identical to tickets purchased with cash.
Anybody else could also refund the tickets for face value in cash. This only works if you get the tickets from the box office because when you get the tickets via the ATMs they are printed differently and cashiers are not supposed to give cash refunds for those. But you can still get passes.
Using your own card it is possible to order and pick up tickets which you then give to your friends. Then you go back to the ATM to "try" and get your tickets. When they don't come out ask to speak to a manager or somebody who can help you. Explain how you ordered tickets and waited for the confirmation (most people who don't get tickets don't realize that they have to wait for the confirmation) but the ma-chine says your order is not found. The management will check your card number on their management station which will show that you were charged for X amount of tickets. No Moviefone or theater computer is able to tell if the tickets were picked up or not. Only the time the theater received your order, number and type of tickets purchased, your credit card number, and the name of the movie is recorded. They will walk you and another group of friends in so that you can join your friends already in the theater.
The management's station keeps a list of all credit card numbers used. During a busy weekend day you could pull up 500 or more credit card numbers.
For instance, at Sony/Loews theaters they use the Prism Theater Management System. From the main menu you click on Daily Operations then click on Credit Card Management. The first selection on this screen is the one they use to see if your card has been billed. You enter the card number and it searches back up to three months (default is 14 days) and lists the tickets you bought.
The other or second selection on the credit card management screen will give you a list of all credit card numbers and other information previously listed with an option to print to screen or printer. Prism puts 36 card numbers on each page. When going to this screen it sometimes says "Error" but just click OK.
Even after you use your own card you can call Moviefone for a refund at 800-745-0009. Tell them you never went and picked up the tickets or that you want to know what this charge is as you have never used Moviefone in your life. (You can also call 800-745-0008 to change showtimes or perform other managerial tasks.)
There are many other uses for Moviefone, like using it as a DTMF decoder but this should give you a basic idea of some of the possibilities.
For more information from them, email info@moviefone.com or check out their web page at web18.movielink.com.
Dear 2600, Thirdhorse gave the 800-745-0008 to change showtimes and other managerial funtions. Changing showtimes will only work for the Moviefone network and will not cause the theater to change its schedule. However, it will cause people to be late for their movie which will make not only Moviefone look bad but the theater will have to do something to make amends with the customer. On a busy opening night for a summer blockbuster this could cause quite a problem. What I would really be interested in knowing is if Thirdhorse or anybody else for that matter has ever tried dialing directly into the ATMs? Or what about monitoring the traffic between Moviefone and it's ATMs? I am unable to experiment in this area due to my being a white trash asshole without a computer or job to pay for one. There was a manager at a theater in New York who used a variation of Thirdhorse's plan and was able to steal $104,000 in nine months. Not really hacking, but interesting. killerclown