Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Phreaking Public Phones :: payfnass.htm

Assaulting Payphones 1.0
Assaulting Payfones 1.o

 Assaulting Payfones  1.o  \
------------.                                    * * *    c/a    1o-17-oo    :
 Disclaimah  \                                                               .
This material is presented for informational and entertainment purposes      :
only, and to satisfy the curious. Any activities described in this file      .
which involve vandalism, theft, or any other illegal activities are          .
recounted from third-party conversations. I do not condone or encourage
vandalism or theft. I do not accept any liability for anything anyone        .
does with this information. So, don't shoot the messenger. Remember:
Looking is one thing, but busting up payfones is ILLEGAL.

 Table of Contents  \
   [  Removing the Cover  . . . . . . . . . . . . . . . . .  line  32  ]     .
   [  Accessing the Lines   . . . . . . . . . . . . . . . . .     11o  ]
   [  Removing the Card Reader  . . . . . . . . . . . . . . . .   157  ]

 Removing the Cover  \
This is so easy it's almost not worth going into, but people always ask.     :
I figured this out when I was about thirteen years old and I used a coat     .
hanger. I'll present the coat hanger method, as well as how to fabricate     .
a proper key.
= Method #1 =

Take a coat hanger made from very stiff wire and unbend it. You don't        .
have to do a very nice job of it, you just need a stiff piece of wire to
work with. I suggested a coat hanger because everybody has one, and also
for nostalgic purposes.

Bend the coat hanger and pull it across itself, right side in front of
left, so it forms a little loop at the bottom of the bend. Pull it tight
until the loop is about 8mm in diameter.

Now form the ends sticking out into a handle of sorts. Be creative. Break
off any excess wire by bending it back and forth with pliers.

Done. The following diagram may help you, but probably not since it sucks
to an extreme degree. This is sort of what it looks like anyway.

  wire crossed over and       _____  ______
   formed into a handle -->        \/
                                  /  \
                                 /    \
                                /      \                *blink*
                               (        )
                                \      /                   *blink*
                                 \    /
                                  \  /
                little loop -->    ()

= Method #2 =

Making an actual key is pretty easy too. Get a small sheet of metal that
is easy to work with and rigid enough to handle some torque. Now cut it
according to the diagram below. Yeah, this is what shop class is for.
Important dimensions are noted.

                  handle -->  [___   ___]
                                  | |
                5mm wide -->      | |
                                 _| |_
    10mm wide x 5mm high -->    |_____|

= Doo-be-doo =

Well, that is that. Someone could simply stick their homemade key into
the hole that looks like this...   _   ..., give it a twist, and pull
the cover off.                    | |
                                  | |
The little loop in the "Coat     (   )
Hanger Method" is the part        | |
one would stick in the hole.      |_|

This works on Centurians and the slot is located on the top. Millenniums
and Fortress Phones both have this slot located on a small panel on the
front of the payfone, in front of the coin box. I havn't been able to open
them with the coat hanger method, just twists the hanger up. Perhaps with
a strong fabricated key and a wide handle for lot's of torque. Or maybe
you need to unlock the lock located on the side of the payfone first.
These locks require a real key. Who knows.

When you are finished nosing around, make sure to replace the cover and
lock it back up.

 Accessing the Lines  \
Again, this is easy stuff. Accessing a payfone's lines really depends on     :
the payfone and installation. Sometimes you will see the fone-line running   .
right out of the payfone and across the wall. With pillar-mounted payfones   .
there is usually a panel on the pole beneath the fone that can be easily
opened with the appropriate tools. In payfone booths you will also find      .
panels that can be removed to reveal the line, above or beneath the fone.
And of course, if you can see the wiring coming out of the top of the
booth and going up to a pole, it can be accessed there. Regardless of the    .
installation, if you take a look you will see that a payfone's fone-line
can almost always be accessed.

Note: Many of the panels spoken of are fastened with "security screws."
You know those odd shaped screw-driver heads that most people don't have.
Here in Canada you can find sets of these odd-shaped bits at Princess Auto.
Scour your local tool and automotive supply stores and you can probably
find some.

Warning: There are also high-voltage lines running into payfone booths to
power the booth-light. When messing with electrical lines it is always wise
to exercise extreme caution. Or better yet, don't mess with them at all.

So, what can be done with a payfone's fone-line? Well, it is possible to
beige box from at least some of them. Generally works on Paytel COCOTs,
Millenniums, and probably other COCOTs. Just hook up to the red and green
wires. (duh) If you don't know what a beige box is... well, it's just a
regular fone-set with some alligator clips on the red and green wires
that you can use to patch into a fone-line. Also known as a linemans
handset. If you still don't get it just do a search for "beige box" on
the web. It's one of the oldest boxes and the information is everywhere.

Now, a payfone line has four wires in it. Red, green, black, and yellow.
We know red and green (ring and tip respectively) are used for the voice
communications, and can be exploited for beige boxing as mentioned above.
The black and yellow wires are used to control the coin mechanism relays
and solenoids. If you cut these wires no coins will be returned on calls
that can not be completed. If the wires are reconnected, and the handset
is lifted and put back down, the coins will be released. Neat-o. However,
it sounds far cooler in theory than in practice. This is an old scam and
your telco likely knows all about it. It is obviously illegal and doing
this habitually will surely lead to your arrest. Oh, and as far as I
know this only works on Centurians.

 Removing the Card Reader  \
     And the Lord said, "let there be little yellow cardreaders upon         :
     every fone so that the people may go out and harvest the bounty         .
     wrought of the telcos." -- XX                                           .

The method covered here applies to Millennium payfones. Now, you really      .
shouldn't be doing this. Millennium payfones cost several thousand bucks.
If you are caught vandalizing one, the penalty will be quite heavy. Fone
companies do not look kindly on people messing up their equipment. And       .
again, this is all third-hand information. Don't look at me.

A payfone is usually a heavily armored unit with secure mountings and
impenetrable housings to disuade peoples thoughts of emptying them of
their silver booty. The Millennium payfone card readers, however, are a
soft-spot indeed.

Tools required:

   *  Hammer
   *  Big flat-head screwdriver
   *  Knife (optional)
   *  A desire to commit a criminal act

Place the head of the screwdriver against the slit at the top edge of the
card reader. Pound it in a few inches with the hammer. Apply downward force
on the handle of the screwdriver until you create a large enough gap to fit
the claw of the hammer in there. Insert the claw of the hammer into the gap
with the hammerhead facing up. Yank hard on the hammer in an upward dir-
ection using the front of the fone as a fulcrum under the head of the
hammer. The yellow faceplate will come off, either with or without the card
reader attached. If it's not still attached to the yellow part you can just
reach into the hole and pull it out. Use the knife to slash the ribbon
cable or just yank really hard until it disengages from either the reader
or the mainboard in the payfone.

At this point the payfone might be quietly going beedley-boop-beedley-boop
and displaying some message on the screen about re-inserting your card or
something. Not an alarm, just an error notification. It is not known if
this causes the payfone to fone home for help. Probably not, since the
error on the screen seems to indicate that the fone thinks there is simply
something wrong with a card in its slot... which it no longer even has. Go

It has also been noticed that when missing card readers are replaced by
the telco, reinforcements are often added to prevent them from being
emancipated again.

The card reader is an American Magnetics ( Model # 170.
It has both a magstripe reader and a smartcard reader/writer. Exactly how    .
these card readers can be interfaced with a PC is a story for another day.

Play safe. And if you ever happen to catch yourself vandalizing payfones,    .
call Crime-Stoppers at 1-800-222-TIPS... That's wun-aight-zee-row-zee-row-
too-too-too-aight-phore-sebbin-sebbin. Jeah.                                 .

                                                           .   '
                                                        .    .   '  `
        ,;;%$$$%%%&;,.                             '  (   .         , )
     ,&$$$&$&$$L.`'"4%%&,.                       . .   `       *   ,    )
    &$$&$&$&$$$$$$&;, `"&%%&,.                 .  (       .          . ,
   &$&$&$$&$$$$$$$$$$$%, `"&%%%&.             (    (   '           *     `
   %&$&$&$$$$$$$$$$$$$$$&;, `"&%%%&.           ` .  `(    . * `  *, ` '   )
   $$&$&$&$$$$$$$$$$$$$$$$$$&, `"&%%%&.         (     ` .          )    )'
   `$$&$&$&$$$$$$$$$$$$$$$$$$$$&,  `"&%%&.       `(    (    .*  `  ` ) '
    `$$&$&$&$&$$$$$$$$$$$$$$$$$$$$%;, `"&%%&.      `   .   (      * ' .
      `$$$&$$$$$&$$$$$$$$$$$$$$$$$$$$$&, `"&%%&.      `     `   @  * '
        `&$$&$&$$$$&$$$$$$$$$$$$$$$$$$$$$&, `"&%%&.     `(  @ *  *  .
          `"$$$&$&$$$&$&$$$$$$$$$$$$$$$$$$$$&, `"&%%&.     *   . @ *
             `:$$$$$&$&$$&$&$$$$$$$$$$$$$$$$$$$&, `"&%%&.   ` @ *  )
                `"&$$$$$&$&$&$$&$$$$$$$$$$$$$$$$$$&, `"&%&.    . @.
                    `"&$$$$&$&$$&$$&$$$$$$$$$$$$$$$$$&, `"&%&.  `*`'
                        `"%$&$$&$&$$$&$$&$$$$$$$$$$$$$$$&, `"&&. '" _
                            `"&$$$$$&$&$$$&$&$$$$$$$$$$$$$$&, `"&.'/ :
                                 `"&$$$$$&$&$&$&$&$$$$$$$$$$$$&, `'. :
                                      `"&$$$$$$$&$&$&$$$$$$$$$$$$&, `\
    CRA$HING DOWN THE TELEC0M INDU$TRY                  ``'"&%$$$$$$%'
         { one payfone @ a time }                                 \_:

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2019 AOH