Access Tandem Codes and the Hidden Phone Network
by Brandon
There are many, many secrets in the phone network, but few as well kept as the access tandem codes.
These date way back - maybe even to the time when direct-dialing first appeared.
So what are access tandem codes? Simple! An access tandem is a machine in the local phone network whose main purpose is to connect you to long distance networks or other local offices with subscribers. So an access tandem code, quite simply, is a code that points on that equipment. The format is pretty straightforward.
For example, a call to the access tandem in Des Moines, Iowa is reached by dialing 515-089 and any last four digits. So basically, an access tandem code is a phone number beginning with zero. Since this is supposed to be unheard of, dialing can be a bit of a challenge. So we'll cover some of the ways we've found to circumvent the traditional restrictions.
From a mobile perspective, AT&T's non-prepaid network or a Sprint phone will usually just place the call, no questions asked. If you happen to be using Sprint, regardless of the kind of phone you have, sometimes they'll route your call to things within an access tandem code other than what you intended to call.
Dialing these codes is also a pretty straightforward task on a landline, but how to go about doing it depends on the kind of switching equipment that runs your phone line. A switch is a host to a telephone; all your phone does is convert audio into something you can use. Everything that makes your phone a phone is part of the switch. Anyway, DMS-10s and EWSDs will occasionally just let these calls go straight through. Fortunately, if you aren't served by one (www.telcodata.us/search-area-code-exchange-detail will let you know with reasonable accuracy what's running under the hood) or if your switch isn't cooperating, there are a few ways of circumventing the block.
The first method has the most success on DMS-100s and GTD-5s; if you know what the carrier access code is for your carrier, stick it in front of the call. For example, if you were using Sprint, dialing 101-0333 before the number would get you around the restriction. Your switch tacks this code onto all your long distance calls, so it's something that'll be part of your phone account. It's not known exactly why this is, but a GTD-5 is known to block access tandem codes on three-way attempts.
The next way is a little weirder. Some carriers have long distance equipment that's programmed to allow you to get a dial tone from it if you're a customer. Using Sprint as an example again, dialing 101-0333# will give you a 400 Hz tone from the equipment. From there, you're free! Your switch has no say in what you're calling. Well, for the most part. A lot of the long distance network isn't provisioned to directly deal with toll-free or some other numbers, so if you choose to try anything that isn't a normal number, some odd things can happen.
Some Voice over IP (VoIP) providers do allow this sort of traffic to slip by - more specifically, some of the shadier ones.
Let me explain - when you make a long distance call, your carrier has to pay termination fees for every minute you're connected. In rural areas, this can be higher then a couple of cents per minute, so they could be losing money every time you call rural America. To get around this, some of them buy minutes from people who literally just have a bank of phone lines with unlimited long distance accounts. That way, the carrier who actually connects the call is stuck paying those fees, and sometimes they just happen to let these slip by. Since routes are different for different areas, this doesn't work consistently, but it's common for routes to change frequently, so you could get lucky. Occasionally, some Voice over IP routes will work with CenturyLink's 958 codes, but you may hear an error message before they go through. Just keep waiting - if a route to them is available, you'll get it eventually.
If all else fails, the absolute easiest way to dial access tandem codes is to just get a calling card. The AT&T ones sold at Shell stations work pretty much universally for access tandem codes. The 959 codes near the bottom of this article also work on AT&T cards. The one thing to watch out for, though, is the fact that instate calls will cost more (the polar opposite of IDT's cards actually, which we'll cover in a second). You might want to have an out of state friend three-way it in occasionally.
The other card I've found that works is anything from IDT. So long as you get something with their logo on it, I don't think it matters what you get; it all goes to the same platform. This company is so shady, it's hilarious; they're the ones with machines in airports peddling ten dollar cards worth 20 minutes. For those of us not trapped in an airport, the price is reasonable, but the caveat for these cards is they work pretty much like the Voice over IP method; they're simply just hit and miss. My experience has been they change their routes almost every week, though, so it could be worth a shot. Dallas (214-040-xxxx) is the one exchange I've seen work most with these cards. IDT cards do, as of the this writing, also work with CenturyLink's 958 codes, covered near the end of the article.
So what do they actually hide on an access tandem code?
Perhaps most ubiquitous (and rightfully so, it's one of the most used things in an access tandem code) is the inward operator. An inward operator is just what it sounds like - an operator for operators. Technically speaking, the console they're using is exactly the same, but their main function is to butt in on phone calls. Not for surveillance (CALEA equipment pretty much covers that), but like an aggressive form of call waiting.
Here's how an average conversation will go when you want to perform an intercept on, say, a call in Seattle:
"Inward"
"Yes, can I have an intercept on 206-555-1212, please?"
"Certainly, could I get your name?"
"Bob"
"Please hold" (As the operator calls out to the distant number, you can hear a blip of their call before silence.)
Then the operator will ask the called person if they want to interrupt their conversation in the name of Bob. If there's silence or a sound other then a person talking, the operator will let you know what's going on before telling you to try again later.
Easy, huh?
You can also ask them to do Busy Line Verification (BLV)! Sounds exciting, I know, but if you're up for a challenge, there's another thing these operators can be used for: phantom traffic.
I'll leave it to your imagination as to how you ask for this, but when you make a phone call, there's a lot of data that's sent with it; your number is sent in two different fields, the switch that makes the call inserts a number to identify it with, the kind of phone you're calling from, where your call was forwarded from (if applicable), and if any more forwards are acceptable - basically, it's a mess.
Phantom traffic is the phone equivalent to Tor; the only thing associated with the call is a destination number.
Another thing you'll find a lot of are 10x tests.
When you find these in the wild - on access tandem codes at least - they're laid out very evenly; the last four digits will usually be xxxy, where y can be any number, and x corresponds to the test number.
Like a lot of things run by phone companies, the names of the tests make no sense, so let me explain:
Code 100: Starts out with a 1004 Hz tone and goes straight to silence.
Code 101: Rings a phone inside the switching office.
Code 102: This one is like the Code 100 test line, but after a few seconds of silence, the tone repeats. And goes back to silence. And repeats...
Code 103: These generally are only accessible in very rural parts of the country, like towns with populations in the triple digits, or Alaska. It's otherwise known as a supervision test; it picks up and hangs up the equipment making your connection repeatedly, often making what's referred to as bit robbing noise as it does.
Code 104: To be honest, I'm a little in the dark as to what these do. They pick up like Code 105 tests and wait for two digits, but the only thing I've seen them do in return is hang up. Here's how AT&T describes them:
"104-type transmission measuring and noise checking provides a test termination for 2-way transmission testing, a near-end noise measurement and far-end noise checking. This termination may be used to test trunks from offices equipped with automatic trunk test frames. It may also be used for manual 1-person 2-way transmission measurements from a test position."
Code 105: These are kinda neat. It'll pick up with a 2200 Hz tone, and start waiting for digits. Different digits will give you different combinations of tones and noise back (protip: try one digit at a time). There's a lot of different variations from one manufacturer to the next, but 0 universally indicates a request to hang up. Some of these are run using real hardware, and will break in interesting ways - 928-055-1050 is a good example of this.
Code 108: Echo test, or loopback, as it's officially called.
Lastly, you can find recordings.
Sometimes you'll find a recording meant to indicate a dialing error, like 612-076-1259 or 602-051-5200. Other times they'll be things meant for employees, like 410-040-9400. In this case, a gruff voice simply says "Non-verifiable." If you stay on long enough, you'll also get an all circuits busy recording. Nothing is actually busy - in fact, it's pretty normal. The Nortel DMS family of switches (excluding the DMS-10) has a bad habit of sticking you on here whenever it feels like it.
Moving on, here's a slightly different flavor of hidden number: 958 and 959 codes!
These are different in the way that as far as the public network is concerned, they don't actually exist; they're a product of the long distance equipment your provider runs - so it's a pseudo private network. The first one I'm going to talk about is also the easiest to get onto just by the way long distance carriers do business. When someone buys minutes from a provider, they're not always their first routing choice. They may not even use them for every route, so it's just stuffed into a list of networks the switch has at its disposal. When a number that's invalid is sent, some equipment will cycle through the networks, looking for one that'll accept the traffic.
Lucky for us, these test exchanges are eccentric enough that there's only one that'll accept it! So the short answer is you can go ahead and dial it, and it'll Just Work.
CenturyLink's network has a pretty self-explanatory way of routing these internal codes; for every city they have a switch in, they assign its area code and the exchange 958 to the switch. For example, they have a switch in Denver, so if your call wanders its way onto their network, 303-958-xxxx addresses the Denver CenturyLink switch. Their network is relatively small, so aside from Denver, there's Seattle (206), Minneapolis (612), Salt Lake City (801), Phoenix (602), Chicago (312), Kansas City (816), Atlanta (404), Charlotte (704), Tampa (813), Los Angeles (213), Newark (201), and New York (212).
CenturyLink, like any good company, most definitely has nothing to hide. Not in the 958 exchange anyway, so there's usually just one of two things you'll find there. The first is an announcement that repeats over and over to help their Voice over IP customers check for packet loss. The second, well, I'm not quite sure how to explain.
A Nortel DMS switch will ring once and pick up silently. The moment that call goes off-hook, the DMS starts counting up to two minutes. If you stay with the silence for those two minutes, it'll hang up and the call will end normally. But if you hang up, that timer keeps going. If you call back before two minutes are up, it'll ring a few times and then send a message back on the call signaling channel saying the call is busy. Subsequent attempts don't ring - it'll just send back a similar message. Once those two minutes are up, though, it goes back to picking up silently. These can usually be found on the lower-end of the 7000 block (7000, 7100, or 7200), while the VoIP announcement is typically towards 7600, 7700, or 7800.
I won't dwell on this much since it's been covered before, but AT&T also enjoys hiding numbers.
Kinda like an Easter egg hunt! Just without any rotting if you miss something - which is an especially good thing, since this is a great example of a time when you need to balance between painstaking levels of detail and just enjoying what you hear.
The AT&T network is huge and has more hiding places than a drug smuggler's car. So for now, let's just cover the basics.
Pick almost any American area code with a 1 or a 0 as the middle digit, and then dial 959-6904. Chances are, if AT&T is handling the call, you'll probably get a scratchy recording telling you an earthquake stopped your call. Welcome to the weird, weird world of the 4ESS; AT&T's brand of long distance equipment. There's too many to list here, but for every state in the U.S., there's at least two of these, and a good number of them let you hear the strange local varieties of disaster messages among other things. These usually gravitate towards 959-6900 through 6920, while some of the tests described above sit near 959-10xx.
So there you have it!
Whether it's been an excuse to kill some time on a gray day or a primer to exploring some of the other hidden parts of the phone network, I hope you enjoyed reading this.