Sam Hallas' Website
Here is a sequence of articles I prepared for the Telecomms Heritage Journal about how certain folk cheated the phone system, some times it was fraud but at other times it was just for fun.
Every now and then the topic of phone fiddling turns up in the Telecomms Heritage Group mail list. Often someone has read about the so-called ‘phone phreaking’ which took place in the United States in the late 1960s and early 70s. However, here in the UK we were equally clever at finding ways to cheat the Post Office; and in return the Post Office became more and more adept at countering them.
Here is a collection of fiddles known to cheats and pranksters that allowed a telephone user to manipulate the telephone system in ways never intended by the designers.
As usual, you can click the images for a larger view: Esc to return or click the 'X'
It has been reported that in the early years of telephony the telephone companies only allowed the subscriber to use the telephone. It was forbidden to let your neighbour use your phone. It was probably an unenforceable rule and seems to modern eyes to be very restrictive. When you become aware that the rental paid by the subscriber included calls, then it starts to make sense. The rental set by the company had to amortise the capital expenditure on line plant and equipment. It also covered expected maintenance of the line and instrument. Importantly it also covered the cost of an average number of calls. The cost being that of the telephonist’s time in setting up and clearing each call.
So if I used my neighbour’s phone to make calls, it didn’t cost him anything, but the increase in operator’s time to more than average meant that the telephone company lost money.
The Post Office introduced a facility whereby a call was paid for by the recipient. It was ideal for family calls, for instance, for sons away on military service to ring home to fond parents. It was called a ‘Transferred Charge Call’
Miscreants realised that it might be possible to make a transferred charge call to a public call office, where there was no subscriber to pay the bill, thereby getting a call for free. Now on manual exchanges call office lines were easily distinguished on the jack field, thereby putting a stop to this.
With the introduction of automatic working it became harder to tell what sort of line was receiving the call. In order to make it obvious to the operator setting up a transferred charge call the numbers of call offices were given extra digits. An example from an Oxford college in 1957 shows the digits ‘11’ added. [Images: Roger Harris] In later years on the mainland it was a letter ‘X’ that was added. In Northern Ireland, for no obvious reason, the extra digit was ‘1’. It’s not clear whether this was effective in stopping the scam as the fraudsters would probably be wise to the extra digit ploy and would simply not quote it.
Callbox interior
With the introduction of automatic working to call offices it became necessary to allow a caller to speak to the operator without charge when requesting a call that had to be set up manually, such as a trunk call, or when making an emergency call.
The equipment in a call box comprised a table telephone and a coin collecting box with two buttons marked ‘A’ and ‘B’. The telephone has a special dial, Dial No 13FA or 22FA which has an additional set of contacts which short out the pulsing contacts on dialling digits 1 to 8 when no coins have been inserted in the coin box. If digit 9 or 0 is dialled the contacts open allowing the dial to function normally to call either the operator on 0 or the emergency service on 999.
Dial No 22 [Bob Freshwater]
The wily caller who understood how telephones worked realised that by tapping the telephone cradle rest pulses could be made that simulated dialling. Those with a steady hand could tap out the required number and obtain a free call. A good rhythm was called for and it is said that amateur radio operators with a ‘good Morse hand’ could tap the best. If a technician was in the exchange near to a selector being stepped in this way, any erratic pulsing by a ham-fisted person was very obvious and he could take steps to disconnect the call.
Another technique to gain free calls was known as ‘back dialling’, but it required a good deal of skill and practice to work. The caller needed to wind the dial as if to dial 0 but stop its return after the required number of pulses had been sent.
A much simpler scheme for the adventurous was to unscrew the telephone by releasing the screws from the parcel shelf top. Then it’s only a matter of insulating the extra contacts that short the dial springs using a piece of paper. The Post Office very conveniently placed a directory full of pages suitable for tearing off a corner.
A technique only available in the London director area involved carefully dropping an established unanswered call such that the connection was held to the intermediate tandem exchange.
Calls from a London director area telephone to exchanges in the surrounding country were routed through an intermediate tandem exchange known as Toll A. A tandem exchange has no subscribers and exists solely to switch calls between other exchanges. Besides the nearby non-director exchanges Toll A also had connections to more distant exchanges to allow London operators to connect trunk calls by dialling. As the automation of the network increased this allowed access to a wider range of destinations via portals such as London Kingsway and Faraday trunk exchanges.
A caller would dial the 7-figures required to connect to a number outside London, preferably a spare number. The first three digits would be passed to a director which performed the translation of the route and would pulse out the required routing digits. The first digit would route to Toll A and then the routing to the distant exchange would be sent to Toll A. Finally the last four digits would be repeated to the distant exchange. At this point a tone would be returned to the caller, either ring tone or unobtainable. The caller would then execute a deft flick of the cradle rest which would make the distant exchange and the route release leaving a connection to an incoming first selector at Toll A.
Naturally proceeding further required a knowledge of the routing codes from Toll A.
Widely circulated among the student community were the numbers that allowed calls to be made free from a payphone in London.
The magic number was a code for a director exchange followed by two digits. To make a call one would dial the magic number plus the first two digits of the number to be called which would make what looked like a legitimate London number. The caller would then wait for the director to release and continue dialling the rest of their required number. When the called number answered the supervisory condition was not returned so the call was entirely free. Once Subscriber Trunk Dialling (STD) was available, trunk calls could also be made for free.
Later research showed that such numbers were designated as SDBC, thought to stand for ‘Series dial breakdown codes’. It is believed that this facility was introduced during WW2 to allow operators to access dial tone at a nearby exchange if their own equipment was damaged by bombing. Why they were still working in the 1960s is not known.
As automatic working became more widespread from, say, the 1950s onwards, it became simple to dial calls to adjacent exchanges which were within the local calling area. Codes became more standardised following the introduction of STD in 1959. Typically users connected to the exchange in Town 1 would dial a code such as 91 to reach subscribers on Town 2 exchange and similarly users in Town 2 could dial calls to both Town 1, by dialling 92, and Town 3 by dialling 93.
Now it was quite likely that a call from Town 1 to Town 3 was beyond the range of a local call. However in many cases it was possible for a caller from Town 1 to dial 91 and then 93 to reach numbers on Town 3 exchange. Such calls should have been blocked and it was technically simple to do so. However it was often expedient to share incoming selectors from a route such as from Town 1 with calls coming in from another exchange which was allowed to call Town 3.
With a knowledge of the different routing codes it was possible in the 1960s to dial calls going a prodigious distance. Local connections like these were not amplified, so the further you went the quieter the call became. Such calls were not free, but were only charged at local call rate for a trunk-rated call. On answer the supervision signal took some time to propagate back to the originating exchange leading to a series of galloping clicks getting nearer.
A prankster knowing the codes could dial 91 from, say Town 1 to Town 2 and then dial the return code 92 to come back again. He could repeat the process until busy tone was returned confirming that all the circuits between the two exchanges were busy. A rather anti-social practice. It would also startle any technician in the exchange who happened to be close to the selectors when the call was released. The simultaneous clearing of all the selectors would have certainly made him jump.
This simple circuit copied the way that changed number interception worked and made it possible to answer an incoming call without charge to the caller.
During ringing of a line on a Strowger exchange the line polarity is reversed from the normal used during speech. The final selector connects ringing current in series with a relay in order to detect when the call is answered. Once the call is answered the final selector disconnects ringing current, restores the line polarity and connect the speech circuit with a relay to detect the loop of the answered telephone. After the loop is detected the supervisory signal to start metering is returned to the calling party.
Students of circuitry noted that changed number intercept circuits use a rectified loop – ie with a diode – and connected the intercept operator through a capacitor with local battery fed speech path. The operator can therefore talk to the caller without providing an answering loop. It was also known that the carbon microphone used in telephones at the time would work on quite low currents of only a few milliamps. Experiments showed that a resistor of 4.7 kΩ in series with a telephone would allow speech but not draw enough current to operate the exchange line relay. Thus was born the No-charge Termination. A diode in parallel with a 4.7kΩ resistor in series with a telephone was all that was needed.
The dodge was not undetectable. The conditions it caused were the same as if a caller had hung on to a call after the called party had put their phone down. After a timeout period a deferred alarm would be displayed as Called Subscriber Held (CSH). This was to prevent a fault or a malicious caller holding a line busy and preventing outgoing calls.
Following the introduction of STD in 1959, call box phones changed to the new pay on answer type. Tapping the rest as described earlier was of no use to avoid payment.
The curious fiddlers made a study of the Post Office Electrical Engineers’ Journal for January 1959 where all was revealed about how the new system worked. Equipment in the exchange controlled the charging and collection of payment. Once a call was answered the coin and fee check relay set reversed the line polarity to the call box to open the coin slots allowing payment. As coins were inserted the call box phone inserted resistive pulses on the line to signal the value of coins inserted, initially in three pence units, followed by a short break of the line.
In order to trick the system into granting a free call, access to the phone line is needed. This could be difficult in a callbox, but would be much simpler where a renter’s payphone was installed. Such installations were common in university halls of residence.
It was not long before students tried out using a standard telephone with a resistor across the dial springs to simulate coin pulses. Despite the specification being for 4 pulses per second, the 10 pulses per second from the normal dial seemed to work and could be followed by a flick of the cradle rest to give the short break needed after coin pulsing. The use of the series diode allows the dial to work normally to set up the call but once the line polarity is reversed the resistor shunts the dial springs to produced the required pulses.
The ultimate incarnation of this cheat was termed ‘Coin Electronic No 1’ and involved a modification to the handset of a callbox phone. A normally closed reed relay with a 4.7 kΩ resistor soldered across it was encapsulated in resin with short wires protruding. In the callbox to be modified the handset microphone cover was removed, the relay assembly slid into the shaft of the handset and wired in series with the microphone. Then by gently stroking a bar magnet against the handset shaft the required resistive pulses could be inserted followed by a flick on the cradle rest.
This has been a short romp through some of the various methods used over the years to cheat the telephone company. Needless to say virtually all are useless in the present digital age.
However there are more stories to be told about highly technical fiddles which allowed telephone enthusiasts to poke around inside the telephone network to find out how it all worked and to ring round the world. This will be the subject of the next article.
Next: 2. - New naughtiness
Final: 3. - The Telephone trial of the century
Articles Index