[net.followup] Fraudulent use of AT&T Calling Cards

tj@sun.UUCP (05/25/84)

Perhaps a better solution would be to allow the customer
the ability to change thier calling card number whenever they
wanted/needed. Using a method similar to the way a person
can enter a forwarding number, allow a customer to change
thier number, But only from the phone which the number it on.

		Cal Thixton
		Sun Microsystem
		sun!tj

essachs@ihuxl.UUCP (Ed Sachs) (05/25/84)

====================================================
Credit limits sound like a good idea, but they are far from
trivial to implement.  The machines which do the credit card
validation and billing (NCP and TSPS, for those familiar with
AT&T hardware) generate only individual charging records
for individual calls, which are sent daily (or perhaps less
frequently) to accounting computers via tape or data links.
Thus, they have no knowledge of how much is charged, or the
balance outstanding, on an individual account.

An interface back from the accounting computers to NCP (where
the "valid calling card" database is kept) could be created to
cut off calling cards with balances over their preassigned limit,
but there would be a minimum of several days turnaround (assuming also
that the outstanding balance per account is computed more
frequently than once a month, which I doubt).
-- 
				Ed Sachs
				AT&T Bell Laboratories
				Naperville, IL
				ihuxl!essachs

rfg@hound.UUCP (R.GRANTGES) (05/25/84)

[]
Mr. Martin: Since I have nothing whatever to do with Calling
Card Service (well, almost nothing) I feel free to reply to
your flame.
You seem to feel strongly that while $1 million is too much to
charge little old ladys, it is perfectly allright, even imperative,
that they be charged their choice of $100, $200, ... or whatever,
whenever their calling card number is used fraudently.  I guess I
don't see that as any solution.
Let me assure you that , in the past and even today, to accomplish
what you suggest would not be nearly as simple as 'writng a few lines
of code.'  In fact it would have been very difficult and expensive
to do so.  Changes are taking place in the AT&T-Communications
network (i.e., "Long Distance") which at some time in the future
may make something like what you propose feasible at modest cost.
However, I am not aware that there is a perception within the
business that this needs to be done, let alone done with alacrity.
Of course, there is no reason for me to be aware as it is not my
responsibility.  Perhaps someone closer to that sort of thing will
reply to you.  Lacking that, I suggest you continue your efforts to
raise consciousness.  One way to do that is to spread your own
number around sleazy motels and try to become a statistic.
Since you are on the net, there is a good chance you went to one of the
many schools whose campus papers felt it obligatory to instruct
their readers in how to get free calls using Ma Bell's calling
card numbers. I'm sure you wrote letters to the editor opposing
their actions. I'll bet you did. It seems everyone wants to beat the
system, or the company, or Ma Bell (they succeeded there), but no
one likes the idea of hitting the little old ladies.
Dick Grantges hound!rfg

wapd@houxj.UUCP (Bill Dietrich) (05/25/84)

Well, I work for AT&T Bell Laboratories (too), and I have often
wondered why those few lines of code to prevent million-dollar
bills weren't added.  All other credit cards have a limit mechanism
in place, and the phone company is in a more centralized position
than VISA or MASTERCARD (after all, you are already talking to
an operator or a computer when you place a credit-card call;  when
you use VISA the storeowner has to spend money to call a VISA number).

The least AT&T could do is flag high bills immediately so it can only
happen for one month.  Many seem to go on for several months.

The phone company always ends up picking up the tab, so I don't see
where the "so it's okay to stick old ladies with $100 tabs ?" argument
makes any sense at all.

I'm surprised at the snide tone of the response to Martin's original
article.  How about some common courtesy, folks ?

				Bill Dietrich
				houxj!wapd

snafu@ihuxi.UUCP (Dave Wallis) (05/25/84)

Will Martin says (about automatic phone calling-card limits):

       .
       .
       .
> I now ask the obvious question, directly to you who program and design
> the systems that implement this accounting and billing: WHY HAVE YOU
> NOT ADDED THE FEW LINES OF CODE THAT WOULD CUT OFF THE VALIDITY OF
> FURTHER USE OF A CALLING CARD WHEN THE UNPAID BILL EXCEEDS A SENSIBLE
> LIMIT?
       .
       .
       .
> 
> Such a limit would be trivial to implement in an automated switching
> and billing environment. Yes, there are areas still not so automated.
> But getting this code in the automated areas would practically eliminate
> these extreme cases of fraudulent use. WHY HASN'T THIS BEEN DONE YEARS
> AGO? 
       .
       .
       .
> 
> Do you feel insulted by the strident tone of this message? You should be.
> AT&T and Bell have a reputation for performance, skill, and advanced
> technology, and there is no excuse for something so obvious to have
> been ignored for so long. The only explanation that comes to mind is that
> the telcos have some sinister reason for WANTING this fraud and publicity 
> to continue! 


I can't say much for your knowledge of computers, but you sure are
good at left-field accusations!  My qualifications, you ask? I work for
ATT designing billing systems programs for large computerized
switches.  I don't disagree that your suggestion would be a good idea,
but you should be careful about nasty generalizations - trivial
indeed! 

First of all, the switches only collect data for billing - they have
absolutely no idea how much a phone call costs.  Billing is actually
done at a Regional Accounting Office on a large mainframe computer,
and such an office can serve many switches. There is no direct
connection between the switch and the regional accoutning office in
most cases, (data is transferred via mag. tape) and in the rest
data can flow only from the switch to the RAO via phone lines.
Most RAO mainframes process enough data that they
must run in a batch environment - they simply cannot process billing
information on a call-by-call basis. Nor can the switch itself afford
the luxury of transmitting data to the RAO one phone call at a time.
The switch must buffer the data until low traffic times (like at
night) when it has enough spare time to do things other than process
phone calls.  A large office can spend up to 10 hours each day
transmitting billing data to the RAO!

Implementation of a credit limit as you have suggested would require
some type of national on-line database. Throughout the country, tens
of millions of calls are made every day, and undoubtedly hundreds of
thousands of those are credit-card calls. Think a database that can
handle that many on-line transactions is trivial? Care to guess how
long you would have to wait for an ok to make your credit-card call?

Also, the capability for one switch to talk to another for purposes
other than setting up a phone call has only been possible since 1976,
and is still not universal - it takes time to implement a new
capability on over two thousand switches( and this is only the tip of
the iceberg for what you want).

Just because something is obvious doesn't mean it's feasible! Anyway,
why do you care? AT&T has never required anyone to pay for long
distance calls they didn't make - AT&T eats the loss. Have you ever
considered the possibility that this problem has already been
investigated, and that the solution would be more costly than the
fraud it is intended to eliminate?

Should I go on? Note that I have not said that the idea is a bad one,
but trivial it aint.

I really wish that you would refrain from wild ranting and finger
pointing until you've thought about what you're saying!


-- 


                              Dave Wallis
                           ihnp4!ihuxi!snafu
                         AT&T Technologies, Inc.
                            (312) 979-5894

scw@cepu.UUCP (05/26/84)

Right on Will!! Go get'em. I also think that there is something wierd with
the way that calling cards are implemented.
-- 
Stephen C. Woods (VA Wadsworth Med Ctr./UCLA Dept. of Neurology)
uucp:	{ {ihnp4, uiucdcs}!bradley, hao, trwrb, sdcsvax!bmcg}!cepu!scw
ARPA: cepu!scw@ucla-locus       location: N 34 06'37" W 118 25'43"

chris@umcp-cs.UUCP (05/26/84)

But I still wonder why (if it's true; I don't have a phone so I don't
get phone bills) someone hasn't put in at least a band-aid:

	if cost > $10000 then
		write message to console
			"Hey, there's something funny about this phone bill"
		save bill in file "odd.bills"
	else
		print phone bill
	endif

(Note that this involves only a small change to the software used to
*print* the bill.  Surely that would not be difficult!)

Something like this might help prevent heart attacks on the part of
the customer receiving the bill, and also help the phone co. catch
such problems earlier.
-- 
In-Real-Life: Chris Torek, Univ of MD Comp Sci (301) 454-7690
UUCP:	{seismo,allegra,brl-bmd}!umcp-cs!chris
CSNet:	chris@umcp-cs		ARPA:	chris@maryland

barryg@sdcrdcf.UUCP (Barry Gold) (05/26/84)

First off, to say that ATT doesn't require anybody to pay for fraudulent
charges but "eats the loss" itself means that ATT requires EVERYBODY to
share the bill for fraudulent charges.

I'll start off by confessing that I've never had a phone credit card
(and probably won't ever get one).  Now I've got a question.
Would it be possible to have some kind of ID handshaking involved when using
a phone credit card?  As I understand it, the current procedure is to simply
punch in a number or dictate it to the operator handling the call.  Why not
add another, confirmation sequence?  (For instance one might punch in the
numbers/letters for one's mother's maiden name or some such.)  Or is this
also technically too difficult?

--Lee Gold
-- 
	Barry Gold/Lee Gold
	usenet:         {decvax!allegra|ihnp4}!sdcrdcf!ucla-s!lcc!barry
	Arpanet:        barry@BNL

hoffman@pitt.UUCP (05/29/84)

With regard to adding code to call high phone bills to the
computer operator's attention:  You would probably have to
have a threshhold for each and every customer to indicate
when a bill is too high.  This means adding yet another database
to the BOC computers.  I know a $10K limit certainly isn't high
enough here... our monthly bill is somewhere around $290K.
-- 
Bob Hoffman
Pitt Computer Science

cem@intelca.UUCP (Chuck McManis) (05/29/84)

Just a couple of rebuttals and points to make here :

1.) When I was going to school at USC in L.A. Pacific Telephone would
send you a bill mid-month if it got over $100. The bill would come
with a note saying if you wanted to pay half now and the rest at the
end of the month. It didn't seem to tough for them, but maybe they 
have better equipment. 

2.) As for the following comment :

>... Anyway,
>why do you care? AT&T has never required anyone to pay for long
>distance calls they didn't make - AT&T eats the loss. ...

Does this mean we don't need to worry about defense spending because 
the Government pays for it ? ATT does not "eat" the loss, they raise
long distance rates. I for one would rather they fixed the problem.

As always these opinins are mine and do not represent an attitude 
or opinion of my employer, fellow workers, or the pot of petunias
on the bookshelf.

			--Chuck