Verizon's Call Intercept
by decoder (mailto:decoder@oldskoolphreak.com)

Introduction:
=============

  Call Intercept is a service offered by Verizon which prevents callers that do
not send any caller id information from directly ringing your line. Instead,
callers hear a recorded announcement informing them that you subscribe to this
service, then they are prompted to record their name for identifcation. If the
caller does not record their name, then your phone does not ring. If they
choose to record their name, your phone rings with a distinctive pattern, and
you have the choice of either accepting or denying the call through an
automated menu. The monthly charge for this service is $6.00, although it is
included in some of Verizon's premium plans.

  While this service does have some flaws, I feel that it is better than
Anonymous Call Rejection (ACR) for certain types of annoyance calls. For
instance, telemarketers can still get through to a line equipped with ACR
without sending any caller id information. There are also some PICC's
(Pre-subscribed Interexchange Carrier Codes, commonly referred to as 10-10
numbers) that can be used to bypass ACR. The reason for this is that ACR is
meant to reject callers who block their number by using *67, however, if an
ANI-F(ail) occurs, the caller id information is missing, and the call goes
through just fine. The display will show 'out of area' and no phone number will
appear. Keep in mind that *67 sends a caller id signal of it's own, while a
Flex-ANI fail will cause the absence of any caller id information, due to the
fact that caller id information is derived from the Flex-ANI. Call Intercept
will not let ANY calls directly ring your line unless a number appears on the
caller id display. ACR is designed to reject certain types of calls and let
everything else through, Call Intercept is designed to accept only certain
types of calls, and reject everything else.


How It Works:
=============

  When Call Intercept is activated, anonymous callers trying to reach you will
hear an announcement expalaining what Call Intercept is, then they will be
prompted to record their name. They can also enter a four digit override code
to bypass Call Intercept. (More on this later) At this point your phone will
ring with a distinctive pattern, and your caller id display will notify you
that it is a Call Intercept call. During this time, and until you decide how to
handle the call, the caller will hear hold music. When you pick up the phone
you will hear, "Someone is waiting to speak with you. For more information,
press 1." You will then hear the callers name as they have recorded it, and you
will have the options of accepting the call, denying the call, playing a 'sales
call refusal' to the caller, or sending the call to your Home Voice Mail, if
you subscibe to it. The 'sales call refusal' is pretty useful. If the caller is
stupid enough to identify that they are a telemarketer, you can have this
announcement played to them. It will inform the caller that you do not accept
telephone solititations and wish to be placed on their Do Not Call list. I have
never had a telemarketer attempt to ring my line through Call Intercept,
although with the new National Do Not Call List, some of these phone solicitors
may become desperate.

  I should note that Call Intercept may not interact well with certain Verizon
services as well as some types of phone calls. You cannot have Anonymous Call
Rejection active on your line with Call Intercept. I suppose the reason for
this is that ACR would take precedent over Call Intercept, and all anonymous
calls would get sent to the ACR intercept message. (We're sorry, the person
you are calling does not wish to speak with callers that block delivery of
their telephone number...or something like that, depending on where you live.)
Also, you cannot use *57 to trace calls that came in through Call Intercept.
Remember, *57 is a customer originated trace, and when you receive a call
through Call Intercept, it is effectively a call transfer. International
cellular calls as well as collect calls made without the assistance of a live
operator may also experience difficulty completing calls to your line.


My Experiences:
===============

  When I first subscribed to Call Intercept, I was asked to choose a four digit
bypass code while on the phone with the customer service representative. This
is the code that you would give to anyone who you wished to have the ability to
bypass your Call Intercept service. Upon hearing the Call Intercept greeting,
an authorized caller would enter the code, and then is able to directly ring
your line, without sending any caller id transmission. The caller id display
would read 'PRIORITY CALLER', accompanied by the distinctive ring.

  According to the Verizon Residence Services User Guide, in former GTE states,
the subsciber would be able to access their Call Intercept service by calling a
toll-free number. Instead of choosing a bypass code while on the phone with the
customer service representative, as is done in former Bell Atlantic states such
as my home state of New York, customers in the former GTE regions would have
their bypass code defaulted to the last four digits of their home telephone
number. When they called the toll-free number, they would be able to change the
bypass code, as well as turn Call Intercept on and off. This number was not
published in the User Guide.

  In the past, when someone would try to ring my line through Call Intercept,
my caller id display would read 'CALL INTERCEPT' in the name field, and the
phone number would come up as my area code followed by all ones. This was the
case until recently, when the display began showing a toll-free number. It now
displayed 1-800-527-7070 as the Call Intercept number. This is the number used
in former GTE states for a service known as Call Gate. Basically, Call Gate
lets you control your phone line in various ways. You can 'blacklist' and
'whitelist' certain incoming and outgoing numbers. You can block or unblock
international calls and calls to premium (900) numbers. You can even block ALL
incoming or outgoing calls. It pretty much gives you complete control of your
dial-tone. These features, along with Call Intercept, are what Verizon refers
to as "Advanced Services."

  When you call 1-800-527-7070, it informs you that you have reached Verizon's
Advanced Services, and you are asked to enter your home telephone number. I
recall attempting to call this number in the past, but it wouldn't accept my
phone number because this service isn't available in my state. After seeing
this number appear on my caller id display as the Call Intercept number, I
tried calling again. When I entered my home telephone number this time, it
accepted it. I was asked for my PIN which is, of course by default, the last
four digits of my phone number. From here I was able to hear or change my
bypass code, as well as turn Call Intercept on or off. Verizon never informed
me that I was able to use this service, and when I first signed up with Verizon,
it wouldn't work for me. Apparantly this number is now being used in the former
Bell Atlantic states to control the Call Intercept feature.


Hacking It:
===========

  This is where the security issue comes into play. You can call this toll-free
number and enter in anyones phone number in New York State who subscribes to
Call Intercept. The PIN will be default every time. The reason no one has
changed their PIN is because Verizon has yet to inform anyone of this service.
Anyone who subscibes to Call Intercept in New York is vulnerable. You simply
dial 800-527-7070, and when prompted, enter the telephone number of someone
in New York who subscibes to Call Intercept. When it asks for the PIN, enter
the last four digits of their telephone number, and you're in. From this menu
you can listen to their bypass code, change it, change the PIN for the
toll-free number, or turn off Call intercept altogether. The service that they
think is protecting them from unwanted and annoyance calls, can actually
facilitate these types of calls because of a security hole.

  There is an easy solution to this security hole. Require ANI verification in
order to initialize the service. It is a common practice for other services
such as remote call forwarding. As a matter of fact, Verizon does require that
the initialization be done from the line which subscibes to Call Intercept in
every other former Bell Atlantic state except New York. If you were to call the
toll-free number and enter a Call Intercept subscibers phone number in Vermont,
Massachusetts, New Jersey, etc., you will be informed that the service must be
initialized from the telphone number which subscribes to the service. Once the
initialization is complete, you may access your services from any telephone. It
is quite obvious that Verizon's customers in those states are also unaware of
the toll-free number to control their service, because they haven't initialized
it yet. Fortunately, ANI verification is used, so they are not left vulnerable.
Why New York does not require ANI verification is unknown to me, but what I do
know is that ANYONE was able to administrate my Call Intercept, and I would
have never known.


Conclusion:
===========

  Hopefully, Verizon rectifies this situation because it simply does not make
sense to require ANI verification everywhere except New York. You could always
spoof the ANI, or beige box from the customers line if you are determined to
access someones Call Intercept, but in New York, you simply need to call a
toll-free number from anywhere you wish and enter a default PIN code. Now you
have control over their acceptance of anonymous calls.

  Other than a large security issue in New York, Call Intercept is a great
service. By subscibing to it, you will recieve close to zero telemarketing
calls. Having your anonymous callers hear hold music while you decide how to
handle the call is pretty nifty as well. I have honestly enjoyed having this
service and would highly recommend it to all Verizon customers. Just remember,
if you are considering subscribing to Call Intercept, or if you already have
it, call 1-800-527-7070 and change your PIN! Especially if you live in New York,
unless I already have!


shouts: Lucky225, accident, Licutis, NotTheory, w1nt3rmut3, ic0n, Captain B,
        Majestic, Scott, doug, phractal, Scr00, WhiteSword, RijilV, Eta,
        parano|a, dual_parallel & bland_inquisitor at Radio Freek America,
        Slipmode at www.slipnet.org and StankDawg at www.binrev.com


Appendix:
=========

From the Verizon Residence Services User Guide (VE-RS-E 5/02):
--------------------------------------------------------------


	CALL INTERCEPT
	--------------

	Call Intercept allows you to manage your calls better by stopping
	invalid telephone numbers that typically appear as "unavailable,"
	"private," "anonymous," or "out of area" on your Caller ID display.
	Call Intercept will tell callers that you do not accept unidentified
	calls and asks them to record their name. If an unidentified caller
	does not record his or her name, or enter your override code, your
	phone will not ring, thus eliminating interupptions from unidentified
	callers. By recording their name, you can hear who is calling, and you
	have several call handling options. You are in control


	How Call Intercept Works
	------------------------

	 *  An announcement will be played for your unidentified caller, as
	    follows: "the number you are calling has Call Intercept, a service
	    that requires callers whose telephone number does not appear on the
	    Caller ID display to identify themselves before the call can
	    continue. To record your name please press the pound key or simply
	    stay on the line."

	 *  If your caller has your override code, which is also referred as
	    your PIN number (see Override Code section), they should enter it
	    now to be immediately connected to your phone.

	 *  If the caller records their name, the call is connected to your
 	    phone. You hear ringing and your caller hears "Thank you. Please
	    hold." They will hear music until you choose how you want to handle
	    the call.

	 *  The ringing pattern you hear will be different from your existing
	    ringing patern and the words "Call Intercept" will appear on your
	    Caller ID unit, so you will know it is a Call Intercept call.

	 *  When you answer, the recorded name will play for you.

	 *  Here are your five options and what your caller will hear:

		When you press:             Your caller hears:
                ---------------             ------------------
		[1] Accept the call         Music, until you answer the phone.

                [2] Decline the call        "The person you are calling is not
                                            available. Thank you. Goodbye."

		[3] Refuse a sales call     "The person you are calling does
                                            not accept phone solicitations.
					    Please add their name to your Do
					    Not Call list. Thank you. Goodbye."

		[4] Send to Verizon         Connected to your Verizon Home
		    Home Voice Mail         Voice Mail service.*

		[5] Hear who is calling     Music, until you answer the phone
                    again                   or make a choice.

	    If no one answers at home, the caller will be connected to your
            Verizon Home Voice Mail (HVM) service or your answering machine.
            If you do not have either HVM or an answering machine, then the
            caller will hear: "The person you are calling is not available at
            this time. Thank you. Goodbye."

	    *you must subscribe to Verizon Home Voice Mail service to hear
             option [4]

	 *  Unidentified long distance callers reaching Call Intercept will pay
	    their normal rates for a completed call.


	Override Code or PIN
	--------------------

	Call Intercept doesn't block calls from family members and friends.
	When you subscribed to Call Intercept, you were either asked to select
	a 4-digit Personal Identification Code (PIN) in the former Bell
	Atlantic states or told that your PIN defaulted to the last 4 digits of
	your home phone number and could change it by calling a toll-free
	number in the former GTE states. You may now give that number out to
	family members and special friends who may find themselves calling you
	from a payphone, from various parts of the country where Caller ID
	information will not be provided, or if they choose to block their
	numbers from displaying on Caller ID display units.

	When these family members and friends encounter Call Intercept when
	calling you, they can enter your override code when asked to record
        their name. Their call with then bypass Call Intercept. Your phone will
	with a ringing pattern that is different from your existing ringing
	pattern to let you know that it is a Call Intercept call. This time,
	the words "Priority Caller" will appear on your Caller ID unit (or
	display phone) to let you know that it's a family member or friend
	using the override code to bypass Call Intercept.



Useful Verizon Numbers (also from the User Guide):
--------------------------------------------------

1-800) 527-7070  Call Gate *(use for Call intercept in Bell Atlantic states)
1-800) 870-0000  Call if you misplace your PIN
1-800) 275-2355  Verizon Repair
1-800) 518-5507  Verizon Unlawful Call center
1-800) 254-5959  Verizon Unlawful Call center (TTY)
1-877) TRACE-4U  Call Trace Information line
1-800) 257-2969  Call Trace line (for GTE states)
1-800) 562-5588  to test All Call Blocking (in PA only)
1-NPA) 890-1900  to test All Call Blocking (in NY & CT only)
1-888) 599-2927  to test All Call Blocking (in New England)
1-888) 294-1618  to initialize Ultra Forward service (call from ANI)
1-800) 284-1687  to initialize Ultra Forward service (in MA & NY)
1-800) 414-9898  to use Ultra Forward (in NY, CT, MA, ME, VT, NH & RI)
1-212) 338-8300  to use Ultra Forward (from anywhere else)
1-800) 483-1000  Customer Service (in PA & VA)
1-800) 234-2340  Verizon's Customer Information line
Return to $2600 Index