[comp.dcom.telecom] Coin Station Fraud Using External Ground

kaufman@neon.stanford.edu (Marc T. Kaufman) (04/06/90)

In article <6056@accuvax.nwu.edu> kitty!larry@uunet.uu.net (Larry Lippman) 
writes:

>In single-slot pre-pay coin stations, the totalizer provided a shunt contact 
>across the rotary or DTMF dial which was not removed until the full initial 
>rate was deposited.  No money, no dial.  End of *this* :-) fraud problem.

So, then, will my Casio Watch/Telephone Dialer work through the mouthpiece?

Marc Kaufman (kaufman@Neon.stanford.edu)
    

pacolley@violet.waterloo.edu (Paul Colley) (04/07/90)

In article <6056@accuvax.nwu.edu> kitty!larry@uunet.uu.net (Larry Lippman) 
writes:

>	In single-slot pre-pay coin stations, the totalizer provided a
>shunt contact across the rotary or DTMF dial which was not removed
>until the full initial rate was deposited.  No money, no dial.  End of
>*this* :-) fraud problem.

I have a friend who can pulse-dial phone numbers by rapidly tapping
the hang-up button.  It's kind of impressive to see him dialling a
number with lots of 9's and 0's in it.  He has about an 80% success
rate (i.e., 20% wrong numbers).

He claims, though I've never seen it, that this works at pay phones
without having to pay.

It requires some co-ordination; I never managed anything better than
the last four digits of my old phone number (1222).

  Paul Colley
  Department of Computer Science, University of Waterloo
  Waterloo, Canada
  pacolley@violet.waterloo.edu or .cdn or .ca

wb8foz@mthvax.cs.miami.edu (David Lesher) (04/07/90)

There was another type of fraud that seemed to be common a few years
ago in San Francisco. The {direct} victim, however was the user.
Someone was opening the one side of the line. Folks would come up, not
bother to listen for DTF, and drop in money. The powerless
one_arm_bandit would hold onto the money. After half a day or so, the
thief would come back, reconnect the pair, and collect all the money
spilling into the return chute.

I don't know if they ever caught him, but I noticed that motels along
Lombard Street had signs for the desk clerk expaining who to call if
the 'pay phone alarm' went off.

On a larger scale, every so often mention shows up of person/persons
unknown who can clean out a coinslot box in 30 seconds. Seems that the
powers_that_be have been chasing {him,her,them} from coast to coast,
following a string of now_empty slots.

Whoever it is, they must eat a lot of vending machine candy bars to
use up all those quarters.


A host is a host from coast to coast.....wb8foz@mthvax.cs.miami.edu 
& no one will talk to a host that's close............(305) 255-RTFM
Unless the host (that isn't close)......................pob 570-335
is busy, hung or dead....................................33257-0335

john@bovine.ati.com (John Higdon) (04/08/90)

Paul Colley <pacolley@violet.waterloo.edu> writes:

> I have a friend who can pulse-dial phone numbers by rapidly tapping
> the hang-up button.
 
> He claims, though I've never seen it, that this works at pay phones
> without having to pay.

I would like to see him do this at pay phones. For one thing, why
bother? Use the TT pad; it works with or without coins being deposited
in dial tone first phones. The other problem concerns how the hook
switch is implemented in coin phones. To prevent (in the old days
before "real" dial tone first) fraud in the manner you describe, they
started using mercury switches instead of leaf contacts. The mercury
cannot possibly follow the speed required to pulse dial numbers with
the hook switch.

BTW, I've seen for myself the mercury switch used inside pay phones.


        John Higdon         |   P. O. Box 7648   |   +1 408 723 1395
    john@bovine.ati.com     | San Jose, CA 95150 |       M o o !

Paul Colley <pacolley@violet.waterloo.edu> (04/09/90)

In article <6166@accuvax.nwu.edu> John Higdon <john@bovine.ati.com> writes:

>Paul Colley <pacolley@violet.waterloo.edu> writes:

>> I have a friend who can pulse-dial phone numbers by rapidly tapping
>> the hang-up button.
 
>I would like to see him do this at pay phones. For one thing, why
>bother? Use the TT pad; it works with or without coins being deposited
>in dial tone first phones.

I guess we're kind of primitive up here; Touch-Tone pay phones are
relatively recent...  (i.e., only common in the last 5-7 years, as I
recall)

There may be a correlation here; it was 1984 when we originally had
the discussion, which perhaps I should have mentioned in my post.  The
next time I see him I'll try to remember to ask if he's done this at a
pay phone recently.


Paul Colley   Department of Computer Science, University of Waterloo
Waterloo, Canada     pacolley@violet.waterloo.edu or .ca

williams@cs.umass.edu (04/12/90)

In article <6122@accuvax.nwu.edu>, wb8foz@mthvax.cs.miami.edu (David Lesher) 
writes...
 
>There was another type of fraud that seemed to be common a few years
>ago in San Francisco. The {direct} victim, however was the user.
>Someone was opening the one side of the line. Folks would come up, not
>bother to listen for DTF, and drop in money. The powerless
>one_arm_bandit would hold onto the money. After half a day or so, the
>thief would come back, reconnect the pair, and collect all the money
>spilling into the return chute.

An even simpler version of this scam is used in many countries - just
jamming the return path somehow.  Broken phones that appear functional
are favorite targets because none of the money is "lost" by the crook
to a completed call, but in lots of places you don't get a dial tone
until after you put in your money anyway. This scam is especially
common in places that have lots of foot traffic and people in a hurry -
train stations, info centers, etc.  You can be on the lookout for
such scams by noticing people hanging around waiting for a particular
phone even when another phone becomes free.  Another clue is when
someone in a phone line lets you go ahead of them.  These guys need to
hang around to watch the phone and grab the money after every few
attempted calls, otherwise some other con artist might beat them to
it.

In Amsterdam, it was a steady source of income for a bunch of train
station regulars - from teenagers to old folks. The phone company
keeps redesigning the phones to make it more difficult.  When they
made the return slot doors harder to jam, these guys started carrying
screwdrivers and bars and just bent the doors to jam the return.  When
they changed the doors again to a cast material to prevent bending,
they would jam the slot with gum or toilet/tissue paper coated with
various disgusting and discouraging matter.  The phone company
recently replaced half the phones in the city with phones that only
accept "phone cards".  These are paper cards containing a magnetic
strip with a number of pre-paid "call units" encoded on it. That way
the phone company gets its money in advance and there's no money in
the phone for the crooks. On the other hand, if you don't have a phone
card and the adjacent regular phone is broken (very common), you're
out of luck!

Vandalizing phones seems to be a national sport in Holland - but
that's another article.  Trying to find a functional phone is a city
can be very difficult.  Often the best solution is to use a phone in a
bar or hotel, but then you'll pay twice the normal rate. 8-(


Leo  c/o  williams@cs.umass.edu

onymouse@ames.arc.nasa.gov (John Debert) (04/12/90)

 From article <6056@accuvax.nwu.edu>, by kitty!larry@uunet.uu.net
(Larry Lippman): 

> >Most coin stations today are DTF (Dial Tone First) and no 
> longer resemble a ground-start line.  A DTF coin line behaves similar 
> to that of a loop-start line (it is actually more complex than that,
> but this will suffice for the purpose of this discussion); i.e., a 
> ground on a DTF coin line will not facilitate any fraud.

Grounding is still used on many coin phones to detect the presence of
coins. This in combination with a a sequence of idle tone pulses to ID
each coin dropped is used to validate a call. It is possible to fool
the phone into thinking that enough coins have been dropped through a
very simple procedure using one nickel. It is also possible to induce
the appropriate signals onto the line once ground has been
established, as was once demonstrated to me. Note, however, that this
does not work on COPT's or other "smart" coin sets. There are other
methods that apply to circumventing these.

jd
onymouse@netcom.UUCP