A Post-Soviet Payphone Trick

by Roman Pushkin

I thought y'all would appreciate the story about public payphones we had back in the 1990s in all ex-Soviet Union cities.  I lived in a relatively small town with a population of 80,000.

The payphone would require you to drop a coin from the top to make a phone call - but only within the city you're calling from.  Regional calls were prohibited for some reason.

I'm gonna tell you the method I invented for making regional and countrywide calls from this machine without a single coin.  It was somewhat tricky, but it worked many times.

I was able to find 2600 Magazine on some BBS nodes, but U.S. dial tones didn't work for obvious reasons.  The post-Soviet Union phone system was a completely different story.

A few notes about how rotary phones work: When you dial the number, it's sending a certain number of impulses to the phone line.  You can even disconnect the rotating device from that phone and attach it to your body - you're gonna feel it.  And this is the reason zero is the last digit on the circle - it's encoded with ten sequential impulses.

The station on the other end is programmed to read those impulses and the pauses between them.  If you want to call 31337, its going to look like: ... (pause) . (pause) ... (pause) ... (pause) ....... (we had five-digit phone numbers in our city).

But how do you make a phone call without a coin?  It turned out there was a hardware bug in this design.  If you pushed the metallic arm that held the handset to about halfway down and quickly released it, you'd generate the impulse that the phone made when you dialed "1".

If you pushed it two times sequentially, you'd get "2".  So now you could call any number if you imitated the rotating speed, which is about two to three impulses per second.  You had to respect the pause as well.

In other words, by only pushing the arm a certain number of times you could call any number within a city.

But it's not that interesting since calls within a city were free of charge if you had your own phone line.  But regional calls!  This is what was expensive.  Subjectively, the price was comparable to like 50 cents a minute.  Nobody was chatting long hours.

Myself and a couple of young phreakers, impressed by 2600, were desperately looking for a way to hack the system.  And we found it!

I know it's a long story, but I promise you'll enjoy reading it!

Before I explain, a few words on how you made regional calls.  In our city you could only dial numbers starting with the numbers 2 through 5.  Other initial numbers were reserved.  For example, 2-10-16 was a valid number.  But 7-22-33 wasn't.

The number "8" was reserved for regional calls.  If you dialed 8-095-212-85-06, you'd end up calling the Moscow number "212-85-06", where 095 is the Moscow prefix.

However, there was no way to dial "8" on the payphone, even if you had a coin.  It would let you know something was not right.  So there was no way to make regional calls directly.

Here I have to say you still could dial 01, 02, 03 for fire, police, and ambulance.  The other number you could call was 07 for the operator.  You could call an operator and ask, for example, to connect you to a certain number, let's say in Moscow.  The way it worked you would just tell them the city and the phone number.

However, you wouldn't get connected right away.  The operator would always asks you for your phone number, so they would have a number to bill.  Every time you talked to the operator, you would have to hang up and wait for them to call you back.  The wait time was normally one or two minutes.  Since public payphones didn't have public numbers, you were out of luck here.  You couldn't ask an operator to call you because you didn't have any phone number for them to call to.

So how the Hell on Earth could you make a regional call from a public phone with prohibited regional calls?

Here is the trick.

It turned out that you could pick a random number and make a note of it.  You just had to make sure they picked up calls and were available at that moment.  You would call them and say: "We're doing a line check.  The next time we call you, in three to five minutes or so, just pick up the phone and leave the handset next to your phone, so we're connected."

This social engineering trick always worked, and it looked harmless.  How the Hell on Earth could somebody take advantage of that?

You would then call the 07 operator from a public phone and ask for a regional call with any city and any number you wanted to call.  You would be asked for your phone number, so they could call you back.  You would provide this random number you made a note of before, and hang up the phone.

You would then quickly call that random guy from a public payphone (you could do it without a coin with the trick explained above).  They would pick up the phone and leave the handset next to their phone, so now you're connected.  You would then have to wait for the operator to dial in.

It turned out that operators had some sort of priority, and they would just connect to you no matter what.  Even if you were on the line with someone else, they could jump into your phone call and do whatever they wanted.

So at this step, the operator simply called the number you provided back and asked for a verbal confirmation, like: "Are you the one who ordered a call to Moscow?"  You would just say "yes" because you were already connected, and there you go.  You could chat as many minutes as you wanted, and this poor random guy got billed.

I just hope at the end of the month they disputed these calls.  I did it many times myself.  In the post-Soviet Union system, often times all you needed was to just refuse to pay to win a dispute, since there was no credit score, credit cards, or things like SSNs.