Payphone Extenders: The Access Numbers That Replaced Red Boxing - Part 1
by Royal
Disclaimer: This article is for educational purposes only, and is not to be construed as advice or instructions. All attempts have been made to provide the most accurate information at the time of this writing, however the reliability of this information is not guaranteed. Any unlawful actions taken by the author depicted in this writing occurred over ten years ago. The author does not condone or encourage any illegal activities, such as telecommunications fraud. Any actions inspired by the information in this article are done so at the reader's own risk. The author takes no responsibility for any damages or legal consequences that may result from such actions.
Note: Most terminology and other technical details are explained for readers who are new to phone phreaking, but feel free to skip anything with which you're already familiar.
Introduction
Red Boxing was more relevant than most people believed after AT&T stopped handling coin calls in the early 2000s, which was addressed in detail in my article "Red Boxing Revealed for the New Age" (23:4).
Today, however, it's obsolete, but there's still another way to circumvent coin prompts that I discovered around that time, which a relatively small group of phone phreaks have known about for years. I can sum it up in two words: payphone extenders.
Instead of playing tones into the phone, we'll take a look at identifying tones from the phone.
The payphone industry is on its last legs.
It took a big hit in March of 2020 when Legacy Long Distance International, Inc. stopped offering their services to entities outside of the corrections industry, according to two employees. Shortly afterwards, most of the payphones in New York City were removed. More recently, Frontier Communications Parent, Inc. got out of the payphone business at the end of 2023. Although some of this information may no longer be current, it's mostly in the present tense.
This is a long overdue subject that I'll be covering in detail, mostly for historical purposes, while sharing the story of how I discovered payphone extenders and the events that followed. Strap yourself in and get ready to ph33r - we're about to get into some payphone phreaking that you'll never learn about at your nearest telephone museum!
A Brief Introduction to Extenders
One of the most common types of numbers exploited by phone phreaks dating back to the "Golden Age" of phreaking (1960s and 1970s) is the extender.
Essentially, extenders refer to numbers that drop you on a dial tone, or allow calls on another carrier's network. Just like diverters, Private Branch Exchanges (PBXes), and Direct Inward System Access (DISA) ports (which you can read about in old text files), they are usually used to make free phone calls. Other uses include making calls less traceable (when your calling number is not passed to the called party), dialing into Bulletin Board Systems (BBSes) and Internet Service Providers (ISPs), and wardialing.
The earliest of these used a combination of inward and outward lines called Wide Area Telecommunications Service (WATS) extenders. You'd call an InWATS (800) number, wait for a dial tone, enter an access code (in most cases), dial your destination number, then wait for your call to be routed via an Outbond WATS trunk.
"950 extenders," as they were called, became the phreaker's new plaything when they were introduced in the 1980s. As the name implies, these are in the 950-XXXX exchange, which gives toll-free, Feature Group B (FGB) access to competitive long distance networks.
During their popularity, they would play a dial tone when called and, like most of their predecessors, required dialing an access code, followed by a destination phone number. Text files from that period noted that the call quality was "crystal clear," making these extenders advantageous for data connections.
Essentially, most of these extenders function like calling cards with a PIN, and phone phreaks would often crack them using software and a modem that could detect a dial tone, or by dialing all the possible codes manually. Text files archived online have more information and I highly recommend reading them.
Now that you know how these extenders work, let's go over different payphones.
Types of Payphones
There are five main categories that payphones fall under, some of which may overlap.
The first four fall into two pairs: smart payphones and dumb payphones, which indicate whether or not any firmware is installed, and Customer Owned Coin Operated Telephones (COCOTs) and Local Exchange Carrier (LEC) payphones, which designate ownership. Hybrids, the fifth payphone type, are crossbreeds with both smart and dumb characteristics.
The class of service for the lines they operate on are important to know as well.
You may have heard of Automatic Number Identification (ANI), a service similar to Caller ID that identifies the phone number of an incoming call. A more extensive service, called Flexible Automatic Number Identification (Flex ANI), enhances it by preceding the phone number with a digit pair called Automatic Number Identification Information Integers (ANI II), which identifies the calling party's phone/line type.
The North American Numbering Plan Administrator, formerly Administration (NANPA) has a complete list of these digit pair assignments on their website where you can learn more: www.nationalnanpa.com/number_resource_info/ani_ii_digits.html.
In most cases, the only II digits you'll come across for payphone lines are 27, 70, and, less commonly, 07. If you find yourself on a payphone with II 29, congratulations - you're in prison!
The first three assignments apply to the following payphone types:
Smart Payphones: - This article primarily focuses on smart payphones, the majority of which are COCOTs and usually given ANI II digits 70 or 07. They contain smart boards that run firmware to perform various functions such as playing voice prompts, determining rates, verifying coin deposits, controlling the duration of the on- and off-hook status, enabling/disabling the handset's speaker and microphone, and routing calls. Some LEC payphones, particularly hybrids, also use this smart technology, in which case the ANI II digits will be 27.
Dumb Payphones: - Dumb payphones are simpler than smart payphones because they're network-controlled rather than firmware-controlled. Coin calls are routed over coin lines provisioned with coin control signaling and, in some cases, sent to the Automated Coin Toll System (ACTS) or a live operator. Most of these phones are LEC payphones. COCOTs can also operate like dumb phones, but these are a rare find if any are active today. In either case, the ANI II digits will be 27.
Customer Owned Coin Operated Telephones (COCOTs): - COCOTs are private phones that are not owned by an Incumbent Local Exchange Carrier (ILEC), and represent the majority of smart payphones today. COCOTs operating on coin lines are rare to none, so if you come across one, chances are the ANI II digits are 70 (or less commonly 07), indicating that coin calls are handled by the phone's internal circuitry. If you do manage to find one on a coin line, the ANI II digits will instead be 27, but any firmware that may be installed could interfere with you getting an ACTS prompt (it's rare, but Red Boxing a COCOT is possible!). These phones are distinguished by placards affixed to them listing their Payphone Service Providers (PSPs).
LEC Payphones: - LEC payphones, referred to colloquially by phone phreaks as Bell-Owned Coin Operated Telephones (BOCOT), are owned by ILECs, and can be smart payphones, dumb payphones, or hybrids. If you can find one, the LEC's name and logo will be on the instruction card, and likely displayed somewhere else around the phone. The majority of these are on coin lines with ANI II digits 27 (a go-to for Red Boxing), while others, which use a smart board to process coin calls, are on 70 and 07 lines.
Hybrids: - Hybrids are smart payphones that are network-controlled and on coin lines, therefore sharing characteristics with dumb phones. Like dumb phones, they use coin control signaling and ACTS, but most functions are handled by smart technology. Since they're both on coin lines, dumb payphones and hybrids share the same Flex ANI digits 27. Verizon payphones, which I wrote about in my aforementioned Red Boxing article, are the best example of this smart/dumb payphone duality, most notably the ones that were in New York City. For instance, in Manhattan a local call was 25 cents for four minutes on a hybrid, and the entire call would be processed by the installed firmware, including an internal coin prompt. In almost any other location the rate was 50 cents for unlimited talk time, but you had to insert the coins before dialing, and a ground test would be conducted on the line to verify your payment. To further highlight this difference, you could get the same 50 cents deal on one of the New York hybrids if you bypassed the firmware, such as by dialing 1167 (same as *67 for Caller ID blocking) before the phone number, causing the same ground test to occur. The relevance of this firmware will become more clear as we get into the topic at hand.
What Are Payphone Extenders?
It all started when a friend and I were pondering how Verizon hybrid payphones were routing their long distance and international coin calls after AT&T, who used to handle them, had completely phased out their ACTS by the end of 2002.
Considering the toll restrictions on these lines, as well as smart boards installed in the phones, we came up with two possible theories: they had to be using either toll-free access numbers or Carrier Access Codes (CACs). Determined to find the answer, I grabbed my backpack full of various electronics and ventured off to different payphones, the most important of which was a partially enclosed Verizon phone with the line exposed above it right beneath the light bulb socket.
After determining what all of these phones were dialing, it turned out that both theories were correct, and I had discovered the key to making free calls from the majority of smart payphones without the need for a Red Box. I'll go into further detail on this process later.
Payphone extenders are toll-free (8YY) numbers programmed in smart payphones for routing domestic (1+) and international (011+) coin calls, and are referred to as "access numbers" by the payphone industry.
They behave similarly to the extenders I detailed earlier, with some differences depending on the company that provides them. Firmware installed in the phones automates the entire process, dialing the numbers using an internal modem after the coins are inserted to place a call.
PSPs, who own and manage pay telephones, subscribe to these access numbers the same way a customer would to a phone company calling card. As of the date this article was written, most of the telecommunications companies that have ever provided these access numbers have gone out of business, stopped offering them to new customers, or discontinued the service altogether.
Some examples include Phone1, Inc. (Phone1), Legacy Long Distance International, Inc. (Legacy), Worldwide Telecommunications, Inc. (WTI), WiMacTel, Inc., Custom Teleconnect, Inc. (CTI), and NetworkIP, LLC. (Mergers, acquisitions, affiliates, and company name changes not included for simplicity.)
CACs, better known as "dial-arounds," provide Feature Group D (FGD) access to carriers.
They use the format 101-XXXX, where XXXX is the four-digit Carrier Identification Code (CIC).
For example, AT&T's CIC is 0288 (0ATT), so if you want to place a 101-XXXX 1+, 101-XXXX 011+, 101-XXXX 0+, or 101-XXXX 0- call over their network, you dial 101-0288 followed by 1-NPA-NXX-XXXX, 011 + [International Number], 0-NPA-NXX-XXXX, or 0, respectively.
(A complete list of Feature Group D CICs is available on NANPA's website: nationalnanpa.com/enas/formCICDMasterReport.do [PDF])
Some smart payphones use these instead of extenders, while others simply dial the number you're calling directly after getting a dial tone. Payphones that are programmed this way are not the main focus of this article, but they can still be relevant.
How Payphone Extenders Work
In order to explain how payphone extenders work, I first need to go over Automatic Number Identification (ANI) and Dialed Number Identification Service (DNIS).
ANI is a telecommunications feature that determines the calling party's telephone number. In Signalling System 7 (SS7, a set of signaling protocols for the Public Switched Telephone Network [PSTN]), there are actually two different types of ANI - more specifically, two parameters in the Initial Address Message (IAM) of the ISDN User Part (ISUP) that is used for setting up calls: Calling Party Number (CPN) and Charge Number (CN).
CPN is the ANI most often used for identifying callers, and the number from which Caller ID is derived. CN, sometimes referred to in a non-SS7 context as Billing Telephone Number (BTN), is the number that is to be billed, if applicable (when available, its value is usually the same as the CPN, but sometimes varies).
To put this in perspective, if you place a call to a number that forwards to another destination, the CPN (along with the Caller ID, if available) sent to the called party is your number, but the CN is the number of the forwarded line since it can be billed.
You can call an Automatic Number Announcement Circuit (ANAC) to find out what ANI is being sent when placing an outgoing call. Most of these test numbers read back the CPN, but others read CN, Flex ANI, and/or Caller ID.
One of the most well-known ANACs is MCI's 1-800-444-4444 which, unknown to most, reads the Caller ID if it's available; otherwise, it reads the CN.
A more reliable ANAC is MCI's "ANI Verification System," which can be reached at 1-800-437-7950; it reads both the CPN and CN as "Calling ANI" and "Charge ANI," respectively.
There's another ANAC set up on the Asterisk PBX that reads the ANI II digits, CPN, and Caller ID Name (CNAM): 1-877-YOU-HACK. The information it reads is subject to change in the future.
DNIS identifies the originally dialed number or trunk of an incoming call. Commonly used by companies with multiple toll-free numbers, the data is usually signaled to a PBX or Interactive Voice Response (IVR) as a four- to ten-digit number.
In the payphone industry, ANI is the number of the payphone, and DNIS is the access number (payphone extender). Companies maintain a(n) ANI/DNIS database for security and billing purposes: when the extender receives this data, the ANI - more specifically, the CPN - can be used to verify that the call is coming from a PSP's payphone before allowing an outgoing call on its platform, as well as to determine which PSP to bill for the call.
The DNIS can also be used for billing by companies that assign different access numbers to each PSP, but the ANI is used more often since it identifies the payphone.
For perspective, before March 2020, Legacy, unlike most companies, assigned the same 1-866 extender to multiple PSPs, requiring ANI verification. This use of ANI/DNIS is the greatest contrast to the extenders I mentioned earlier; other differences pertain to various tones and the automated process, which I'll explain below.
When a customer picks up a smart payphone and dials a number that can be locally rated, the dialed digits are stored in the buffer and an internal coin prompt is played. After all coins are deposited, a dialing sequence is initiated which, in this example, is to a toll-free access number. Then the smart board dials the extender using an internal modem and waits for a tone.
By the time it answers, the extender (in most cases) checks its database for the ANI/DNIS, then plays a tone to signal to the payphone that it's ready to receive digits - this is usually a Dual-Tone Multi-Frequency (DTMF) or dial tone, but can also be one or more other audio frequencies.
If the ANI/DNIS is not verified, the extender will most likely deny the call from going through, or may answer with a reorder or busy tone instead. In response to this tone, the payphone would dial, at the very least, the initially dialed phone number (buffered digits) that the customer intended to reach.
For some extenders, a PIN is dialed before or after the phone number, sometimes followed by # (pound) and/or a short pause. The call is then placed, and in some cases, the extender plays a tone back to the payphone - usually DTMF C - when the called party answers (answer supervision).
Let's take a look at the process, step-by-step, previously used by Verizon hybrid payphones for international coin calls.
The extenders they used were owned by Phone1, the company with those distinctive yellow handsets with their logo printed on them that were installed on a lot of payphones.
One of the access numbers I can reveal for this example, since it's been out of use for many years, is 1-888-852-2546, which had the PIN: 3988
Here's the automated process from start to finish:
- Payphone customer dials international phone number.
- Smart board stores the dialed digits in the buffer.
- Call is locally rated and coin prompt is played.
- Customer deposits coins while payment is verified electronically.
- Payphone dials access number (1-888-852-2546) and waits for DTMF A.
- Access number verifies the ANI it receives, plays DTMF A, then waits for a PIN and phone number.
- Payphone dials PIN (3988) followed by #, then waits for a half second.
- Payphone dials 011 + [International Number (buffered digits)], then waits for DTMF C.
- Access number places the call, then plays DTMF C upon answer supervision.
The smart board may perform other functions during this process, such as playing voice prompts and enabling/disabling the handset's speaker or microphone.
Many payphone extenders are simpler than this example because they don't signal answer supervision with a tone or require a PIN.
If a CAC is used to route the call, the payphone will dial that instead, followed by the domestic or international phone number. This process will vary based on different models of smart boards, their programming, and the companies that own and maintain them.
From the 2000s to the 2010s, Verizon hybrid payphones used the Gemini System III (GSIII) and older Gemini System II (GSII) chassis, provided at the time by QuorTech Solutions, Inc. (QuorTech, formerly Elcotel, Inc., and Technology Service Group, Inc. (TSG) before that). These two smart boards support payphones on coin lines, and QuorTech had an agreement with Phone1 for routing coin calls over their network.
This followed AT&T phasing out their ACTS that handled long distance and international coin calls - the same system that made Red Boxing possible to destinations all over the world. Little did the payphone industry realize that this would lead to a new method of making free phone calls on a myriad of upgraded payphones - by dialing the access numbers yourself!
Getting the Extenders
The best way to get payphone extenders involves two steps: recording coin calls and identifying DTMF tones.
I'll go over some alternative methods as well, some of which don't use hardware or software!
A Recording Setup on a Verizon Payphone
Step 1: Recording Coin Calls: - Continuing where I left off in my story (under "What Are Payphone Extenders?"), I was trying to figure out what Verizon hybrids were dialing by listening from their handset (speakers), but most of the audio was filtered out by the smart board.
I needed to bypass the payphone to hear what was happening in the background, so I first went to the partially enclosed Verizon phone with the exposed line, which was a hybrid using a GSIII chassis.
I had found it weeks earlier and knew I had to return with my equipment, so I put on my backpack and took the subway to the stop near MIT where it was located. Once I got to the payphone, I took out my cassette recorder (I didn't have a digital recorder at the time) and telephone line recording adapter with alligator clips attached to the modular plug. With the adapter clipped onto the pair and plugged into the microphone jack on my recorder, I pressed the "record" button and made four coin calls both inside and outside the Local Access and Transport Area (LATA): local, intra-LATA (local/regional) toll, inter-LATA (long distance), and international.
The audio in these line recordings was not filtered out by the smart board, and I couldn't wait to bring home what I had captured to figure out what the payphone had dialed!
This explains one way to record coin calls.
Only long distance and international calls used an extender, as is the case for most smart payphones. The Verizon hybrid I was using would become disabled if there was a drop in the line voltage from an extension phone (also known as a beige box) going off-hook, but you could get around this by using a line recording adapter or the monitor mode feature on a lineman's handset.
Also, the GSIII chassis filtered out the DTMF going to the payphone's handset, but the older GSII played them clearly in short bursts. These tones can also be heard faintly from the handsets of most COCOTs to this day! Payphone lines are usually inaccessible; because of that, you would record the audio from the handset's earpiece.
When doing this, it's best to use an induction pickup coil plugged into your recorder, ideally one with a suction cup. Additionally, using a recorder that saves audio files in common digital formats is best for the next step since the quality is better and you can transfer the files to your computer.
Once you've found a payphone to record, hold your pickup coil against the earpiece or some place near it to pick up the sound. If it has a suction cup, you can use that to secure it in place, but tape, a rubber band, or mounting putty will suffice. To avoid recording external noise, you should also cover the mouthpiece with putty, sheet rubber, an acoustic coupler, or the palm of your hand. If your recorder lets you monitor what you're recording, plug in your headphones and listen to everything in real time; this will help you pick up quality sound and avoid or minimize unwanted Electromagnetic Interference (EMI).
Once the audio sounds clear, try recording the aforementioned coin calls. If you want your change back, dial a non-supervising (no answer) number, or hang up before the call connects. When you've finished, listen to your recording(s) carefully with headphones on, focusing on the clarity of the tones; they'll probably be low in volume, but they're the key to knowing what the payphone dialed.
Step 2: Identifying the DTMF Tones: - Recognizing Touch-Tones is an important skill to have in phone phreaking, and this is where it will be put to the test. When a call is being processed, DTMF from the handset is usually very faint and overall poor in quality, making a DTMF decoder unreliable. This makes identifying the recorded tones by ear the best option, so I'll focus on how to do that with the aid of an audio editor like Audacity.
If you didn't use a digital recorder that saves audio files, you'll first have to convert your recording(s) to an acceptable format. Once you have digital files, load them in your audio editing software. If possible, choose the Waveform View and Spectrogram View together (Multi-view in Audacity); this will help you see tones that are low in volume and give you two visuals to compare. You won't be able to discern faint tones well, if at all, in Waveform view, but Spectrogram View will display them based on their frequencies, between 697 and 1633 Hz for DTMF.
Screenshot of an Audio File in Multi-view in Audacity.
You need to focus more with your ears, however, so listen carefully to the audio and locate the tones - particularly the ones following coin deposit - then remove everything else to make your task easier.
Highlight each section of the waveform to play the individual tones, then play each DTMF tone from another source such as a tone dialer or DTMF generating program to compare until you hear the matching tone.
It helps to play the unidentified tone on a loop while doing this; when you play the DTMF tone that matches, the frequencies from each source will be close together, but not perfectly in tune, causing an interference pattern and beat frequencies. Beats are heard as an oscillation in loudness, often described as a "wah-wah-wah" sound, and should oscillate at the slowest rate for the correct DTMF digit.
It often helps to play each frequency in the DTMF matrix until you find the two that produce the same effect, such as 852 and 1336 Hz for the 8 key. If you're using a tone dialer, you can try pressing two or more of the keys in a single row or column and it may play the frequency that they share depending on the circuitry.
You can do frequency analysis in the spectrogram as well.
The DTMF frequency pairs, displayed above and below each other, should roughly align with the correct frequencies displayed on the side. Depending on the selection tools available, you should be able to click and drag to select each tone and view their peak frequencies, which are likely to be close to the correct ones.
For example, 709 and 1227 Hz would approximate to 697 and 1209 Hz, respectively, indicating DTMF digit 1.
There are other tools you can apply to increase the clarity of the audio, including amplification and noise removal. The more you familiarize yourself with DTMF and audio editing software, the better you'll get at figuring out payphone extenders and PINs.
Alternative Method #1: Using a DTMF Decoder: - Although DTMF decoders are unreliable for low-quality handset recordings, there are cases when the tones are clear enough to use one, such as Verizon payphones with the older GSII chassis.
Simply play the recorded tones into your decoder's audio input/mic. If you don't have one, you can try playing them over the phone while connected to an IVR or another automated system that reads the digits back to you. You'll get the best results by connecting one directly to a payphone line, which was my original plan for the Verizon hybrid near MIT.
If your DTMF decoder is designed for this, you can simply attach the phone cord to the exposed pair using alligator clips, or plug directly into the phone jack if one is available. If it only accepts an aux/mic input, or if you're running DTMF decoding software and need an audio feed into your sound card, you'll have to use a line recording adapter. Once everything is connected, activate your decoder, place the coin calls that I mentioned earlier, and the DTMF digits will be displayed on the screen!
Alternative Method #2: Identifying Trickled Digits: - Most smart payphones use a feature called "Trickle Dial(ing)" to prevent the line from timing out while the customer dials a phone number and deposits coins. When enabled, most of the DTMF digits to place the call are slowly "trickled" down the line, usually all but the last one, and they're likely the digits of an extender if the payphone uses one. You can use a recorder or DTMF decoder, but since these tones are dialed slowly, you can simply listen to them from the handset and identify them by ear without the need for any equipment!
To begin, pick up the handset and slowly start dialing a long distance or international number. As you do this, you'll hear the trickle dialing in the background, and you can take note of each DTMF digit that you recognize until you have most of the number. You can dial what you think is the correct digit after each tone for comparison, but don't dial too quickly; once you dial a complete telephone number, you'll get a coin prompt and it'll be more difficult to hear the rest of the trickled digits. Don't take too long either, or it will time out and you'll have to start over again. The trick is to dial as few digits as possible to maintain the trickle dialing stage.
You may be able to dial more digits and prolong this stage even further depending on the payphone's programming. Try dialing a * (star) somewhere after the first digit or two to prevent the smart board from recognizing that a complete phone number was dialed. If you don't hear an error message, you should be able to dial more digits without the coin prompt coming on. The trickle dialing is also more likely to repeat in this case, where the payphone gets a new dial tone and starts over before reaching the end of the phone number.
One possible drawback to this method is that you won't get a PIN, though most payphone extenders don't use one anyway. Assuming the payphone dials all but the last digit, you'll only have up to ten phone numbers to scan to find the extender, which you'll recognize from the tone it plays.
Alternative Method #3: Scanning Around Extenders: Once you have a payphone extender, you can scan around the number to try and find others!
Many years ago, there was a small PSP in my area that used a 1-866 access number on many of their payphones that ended with NXX-2412. When I called the numbers in the same exchange between NXX-2413 and NXX-2419, I found many more!
You can try doing the same thing with other extenders by sequentially dialing the numbers before and after them. It's best to do this from one of the payphones that uses the access number you're scanning around so the ANI can be authenticated, otherwise any extenders you call may not respond with a tone that you would recognize.
To be continued in Part 2...
Shouts: I-baLL; 0xF; av1d; Lucky225; greyarea; licutis; Doug from Doug TV; WhiteSword; Enamon; vvn; accident; elf; nes; XlogicX; Murd0c; Rucas; Lowtec; TheKid; agent5; ntheory; LamerJoe; gr3p; dropc0de; handler; micro214; Digi-D; Jolly; ic0n; bagel; Cessna; deceit. Additional shouts to: the old SoCal bridge; BinRev forums; Phone Losers of America; Bell's Mind (PBX); Telephreak; Boston 2600 (the old and new meetings). R.I.P. KRT_. You will never be forgotten.