The UK Phone Phreaking F.A.Q. ----------------------------- ______ ___ ___ _______ __ ___ _____ / __ /\ / /\ / /\ / ___ /\ / \ / /\ / __/\ / /_/ / // /_// / // /\_/ / // \ / / // /\_\/ / ___/ // ___ / // / // / // / / / // __/\ / /\__\// / // / // /_// / // / \ / // /\_\/ /__/ / /__/ //__/ //______/ //__/ / \__/ //_____/\ \__\/ \__\/ \__\/ \______\/ \__\/ \_\/ \_____\/ ______ _______ _______ / ___/\ / ___ /\ / ___ /\ / /\_ \/ / /__/ / / / /\_/ / / / ___/\ / __ / / / / // / / / /\__\/ / /\/ / / / /_/ /_/ /__/ / /\ /__/ /_/ / /\ /_______/ \ /\ \__\/ \/ \__\/\_\/ \/ \_______\_/ \/ Release 1.5 (February 1997) designed, written and typed by Pyro Teknik or pteknik@spasm.redcat.org.uk About this F.A.Q. ~~~~~~~~~~~~~~~~~ While this F.A.Q. answers many questions, it is NOT supposed to be THE definitive guide to phreaking. If you are interested in learning more than is covered here, then I suggest exploring by yourself or asking me if you have any questions, and I may be able to help. BTW - At the moment I'm living in Malta, so I can't really go and check out the new payphone you've just seen! This is the start of a F.A.Q. which I shall be updating every so often as people start asking similar questions on phreaking! If you have any questions that are not covered, then please email me and I'll answer your question as soon as possible. Some of the details in this FAQ may go out of date very quickly, so if you find that something doesn't work or seems wrong, please email me. For ideas, suggestions, comments and corrections - Email: pyro-teknik@geocities.com or pteknik@spasm.redcat.org.uk Please note: I receive a lot of email - around 30 personal a day and over 150 a day on mailing lists. I'm glad to receive mail, but please don't expect an instant response. If you haven't received a reply within a week, try re-sending your message. NOTE: This F.A.Q. and it's contents are designed for informational purposes ~~~~~ only. Remember that phone phreaking can be classed as a crime. Although owning a blue box or any other phreaker device in Britain is not a crime, using them is. I cannot be held responsible, in the same way that the guy who made the kung fu movies is not responsible for you killing a guy with a karate kick that you saw on TV :) Also the information is relevant for Britain, and not America. So don't start complaining about how 141 doesn't block caller ID in your state ! :) Updates: ~~~~~~~ The latest version of this FAQ is available from my web pages: http://www.geocities.com/SunsetStrip/Alley/7705 or faster http://redcat.org.uk/~pteknik Or, you can email me asking for the latest version, and everytime a new FAQ comes out, I'll email it straight to you. Also I'll be posting it to alt.ph.uk and alt.2600, so it should be quite easy to get the latest version. Introduction: ~~~~~~~~~~~~~ For many years people have been interested in phones and phone networks. One of the main reasons of interest was to exploit the phone system and explore 'out of bound' areas. In these areas are such treats as test numbers, loops, recordings, out dials and so on. Out of bound areas include anything from numbers which don't reach people and are not for the general public to long distance trunks and inward phone operators. These days the main reason is to achieve free calls, but much more can be accomplished... Questions: ~~~~~~~~~~ N What is the phone phreaker's ring? U What is a Blue Box and how does it work? What is a VMB and how can I (ab)use them? What is a PBX and how can I (ab)use them? What is a loop? How does pulse dialling work? N What is blind dialling? What are DMTF and CCITT 5? What are the tones used in DTMF and CCITT 5? N How do I send the tones? What are some 3 digit phone numbers? What is a COCOT? N How can I listen to someone's phone call? N What are these noises I hear when I'm on the phone? U Which payphones can I do 'strange' things with? What is the likely hood of stealing a payphone? N Do all payphones let you send DTMF tones? How can I make free calls using BT's Chargecard service? N How old are BT's exchanges? How can I make free calls with a Phonecard? What is Scanning/War Dialling? N I'm worried about being traced, what can I do? U What are some notable things about the UK phones? N This new phone has strange buttons, what are they? N What have people done in the past? Key: [N] means new within the last few versions. [U] means updated within the last few versions. What is the Phone Phreaker's Ring? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The Phone Phreaker's Ring is a 'ring' of phreaking related web pages. The idea is that if you visit someone's phreaking page, and want to know more, you can just click on the ring menu, and jump to another similar page. The idea came from WebRing (www.webring.org) and was started on the 1st Jan. 1997. If you want to know more, or wish to join, check out my info page at redcat.org.uk/~pteknik/ring.htm . What is a Blue Box and how does it work? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A blue box is a small device which usest the 2600hz tone to access the trunks used in long distance and international calls. They were first used in the 1960s when Bell published information on how their long distance trunks worked. Using a blue box is quite simple. First you call a phone number, normally an 0800 89* *** one, as these terminate outside of Britain. These phone numbers use trunks in different countries. From there you send 2600hz which fools the trunk into thinking that you have hung up. Straight after you send a mixture of 2600hz and 2400hz, after which you will hear a [beep, kerchink] sound from the earpiece (this is known as a wink). After this you can then tell the trunk where you want to call. The trunk is expecting your local exchange to handle the billing, of which there is none as you are calling through an 0800 number. To dial a number, you use the CCITT 5 tones, and send KP + Country Code + Area Code + Number + ST. This translates as Key Pulse, the phone number you wish to call, then STart, which tells the trunk that no more digits are to come. When the other end picks up, you and them will both hear the beep you hear when you send or receive a normal international phone call. There may be some delay as you are calling internationally. When we used to dial through China a while back there was a two second delay, which is quite spooky when you are talking. Unfortunately, many countries don't let you manage to access their trunks as they have been trying to stop blue boxers. But, some countries can still be boxed through, just scan some 0800 89* *** numbers. Blue Boxing was still working Summer '96 in the UK, and as far as I know, it still works. What is a VMB and how can I (ab)use them? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A VMB is a Voice Mail Box. These are basically a way for people in a company to keep in touch. The one I have used most is Meridian Mail on a mail system for British Telecom Engineers and Linesmen. Basically, you call the number of the system, and a voice will ask you for your mail box number. On Meridian Mail these are 6 digits long, and then a passcode, anything from 4 to 12 digits. After ten wrong passcode guesses in a row the box would be locked out, and only the system manager can re-enable them. When new boxes were created, they, by default, have a passcode which is the same as the box number. A way to break into the system is find unused boxes, or guess someone's predictable passcode. Once into the mail box, you hear messages that have been sent to that mailbox, and you can change some options and send messages to other people on the system. Sometimes in some mailboxes there is the option to dial out to any phone number you wish. On the VMB system I use, the special mail boxes which were allowed to do this were called the '06' boxes as that was the beginning of the number of the boxes. Unfortunately these boxes were locked out fairly soon as the system manager found they were being used by outsiders. If you find a VMB system and you get in, help is normally available, so give out-dialling a try. The Meridian Mail system I use (when I'm in Britain) is on 0800 318 716, so give it a try. What is a PBX and how can I (ab)use them? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ PBX stands for Private Branch eXchange. This is basically a small private exchange used by a large organisation or company to handle their calls in a nice easy way. Outwith business hours when you call a PBX, an answering service will answer (obviously. I mean an answering service won't invite you round for tea and biscuits with granny now will it?) and depending on the system you may be able to make calls from there. Sometimes after the message, you will here a click then a strange dial tone. From there dial 9 for an outside line and call wherever you want. On other systems you can press a touch-tone during the message and access a tone controlled menu system. From here you may be able to dial out to wherever you like. Unfortunately, traces are on the lines of some PBXs, so if you feel at risk, then call from a payphone. What is a loop? ~~~~~~~~~~~~~~~ A loop is a connection in a phone exchange where two lines are tied together so that if two people call the two numbers, they are connected for free. This can be useful if you want to speak to someone, but don't to give them your phone number. One side of the loop is silent, while the other has a constant loud tone. When both side are called, you can talk to each other, sometimes with an intermittent clicking sound. I've mainly used these when boxing international phone calls, and speaking to friends through a loop in a far off country. These loops are used by the phone company to test phone lines and exchanges. As far as I know, there are no loops in the BT system. How does pulse dialling work? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Pulse dialling works by disconnecting and re-connecting the phone for a very short period of time. For the '1' digit, only one disconnection is signalled '2' for two and so on, up to '0' which uses ten. These disconnections are for less than a second, otherwise the phone is hung up! You can pulse dial on a phone which has a locked or damaged key pad, by tapping the phone hook very quickly, once for each digit. This way you can dial a phone number without having to use the key pad. What is blind dialling? ~~~~~~~~~~~~~~~~~~~~~~~ As far as I know, blind dialling can mean one of three things. 1) Using the option on some payphones which speaks the number you have pressed. So when you press '5' you hear 'five' through the ear-piece. 2) Randomly dialling phone numbers, similar to scanning. Used in conjunction with 0800 numbers to find something interesting. 3) With a modem, blind dialling ignores the dial-tone, ring-tone and engaged-tone. Useful for calling countries which have strange dialling and ringing tones. What are DTMF and CCITT 5? ~~~~~~~~~~~~~~~~~~~~~~~~~~ DTMF tones are the tones that your hear on your normal touch-tone phone. They are made up of two tones, played at the same time. DTMF tones are much easier to use for dialling than pulse. A small program in C can used to generate the tones through your sound card, or you can use BlueBeep, by Onkel Dittymeyer, a brilliant phone program. Or, in the States, they use a radio shack pocket dialler, which also doubles as a silver box and a red box, with a few modifications. CCITT 5 tones are THE tones you want. They are used for signalling on long distance and international trunk lines. Many years back, (1968 I believe) Bell released a small leaflet called 'Signalling systems for control of telephone switching'. This was planned to go only to Bell employees, but they forgot that many colleges and universities were on their mailing list. This leaflet described how the CCITT 5 signalling system worked, and routing for long distance calls. So many young students found out how to blue box, and within a few hours of the leaflet being read, some students had simple blue boxes ready! What are the tones used in DTMF and CCITT 5? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +========================================================+ | Key | CCITT 5 | For | Gap | DTMF | For | Gap | +======+============+=====+=====+============+=====+=====+ | 1 | 700 + 900 | 50 | 50 | 1209 + 697 | 50 | 50 | | 2 | 700 + 1100 | 50 | 50 | 1336 + 697 | 50 | 50 | | 3 | 900 + 1100 | 50 | 50 | 1477 + 697 | 50 | 50 | | 4 | 700 + 1300 | 50 | 50 | 1209 + 770 | 50 | 50 | | 5 | 900 + 1300 | 50 | 50 | 1336 + 770 | 50 | 50 | | 6 |1100 + 1300 | 50 | 50 | 1477 + 770 | 50 | 50 | | 7 | 700 + 1500 | 50 | 50 | 1209 + 852 | 50 | 50 | | 8 | 900 + 1500 | 50 | 50 | 1336 + 852 | 50 | 50 | | 9 |1100 + 1500 | 50 | 50 | 1477 + 852 | 50 | 50 | | 0 |1300 + 1500 | 50 | 50 | 1336 + 941 | 50 | 50 | | 11 | 700 + 1700 | 50 | 50 | 0 + 0 | 0 | 0 | | C12 | 900 + 1700 | 50 | 50 | 0 + 0 | 0 | 0 | | * | 0 + 0 | 0 | 0 | 1209 + 941 | 50 | 50 | | # | 0 + 0 | 0 | 0 | 1477 + 941 | 50 | 50 | | KP1 |1100 + 1700 | 100 | 50 | 1633 + 697 | 50 | 50 | | KP2 |1300 + 1700 | 100 | 50 | 1633 + 770 | 50 | 50 | | ST |1500 + 1700 | 100 | 100 | 1633 + 852 | 50 | 50 | | KP2E | 0 + 0 | 0 | 0 | 1633 + 941 | 50 | 50 | | EO |2100 + 0 |1000 | 100 | 0 + 0 | 0 | 0 | +========================================================+ KP = Key Pulse, ST = Start Send the tone for the number of milliseconds as specified in the 'for' column, then a pause for 'gap' milliseconds. How do I send the tones? ~~~~~~~~~~~~~~~~~~~~~~~~ Normally, you can use the soundcard of your PC - this is the normal way. Or, build a blue-box if you have any electrical knowledge. Or, record the tones onto tape and play them down a (pay)phone. Or learn to whistle well. Personally, I use my soundcard (anything from an adlib upwards) to produce the tones. If you have a CD-Walkman you could make your own CD and record the tones. This would be quite successful (think about it). I might do this sometimes in the near future. What are some 3 digit phone numbers? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Ok, you've probably NEVER heard this term before. That's because I called them '3 digit phone numbers' or 3Ds for short. These are phone numbers in Britain to access BT special services - Caller ID and such like. Strictly speaking, they aren't all 3 digit, some are 4. Anyway, here are some ones which you might want to know: 100 - BT Operator help in making a UK Call. 141 - Block Caller ID. 1471 - Tells phone number of last person who called. 1474 - Call last person who called. 150 - BT Customer Enquiries. 151 - BT Fault Report. 153 - Find a international phone number/country code. 155 - BT Operator help in making international call. 174 - Calls you back. 175 - Identifies your telephone number. 192 - Find a UK phone number. 999 - Emergency Services. You probably know a few of these already, but they do come in handy. What is a COCOT? ~~~~~~~~~~~~~~~~ COCOTs are phones which to a normal layman look and taste like a normal payphone. Actually they aren't, if you look at them, you will notice that in America they don't have any telco logos, while in Britain they have a BT logo and in Malta they have a Southern Bell logo! You can find these phones in shops, restaurants and hotels. These phones normally charge more than a normal payphone, so you'll get less time for your dime/pence/Maltese cents. This is because the owner of the phone is making a profit. A COCOT is connected to a standard phone line, and the owner of the phone has to pay the bill. If he charges more than the normal TelCo charges then he makes a profit. I know of two ways to make free calls from these phones. The first is to look around the phone, and see if you can find where it is plugged into the wall. If it is visible, then just unplug the COCOT and plug in your own hand set. The socket is not always visible, but I know of two cocots this works on in Malta and a couple in Britain. The second method is by entering a code on the handset. This is the first method I discovered. One day, some friends and I were playing with a COCOT and suddenly the dialtone re-appeared. We had punched in the code which the phone owner uses to use the phone without having to put in money. The phone was a 'BT Payphone 200 MK II' although we believe it was actually a COCOT. The code we had typed in was *#2580. After the dialtone reappears, we could call anywhere for free. There is a third method, which only works in America. But seeing as this FAQ is destined for Britain, it ain't much use! How can I listen in to someone's phone call? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I know of two methods of doing this: 1) On many new payphones, there is a facility for deaf/impaired hearing people to pick up the phone call with their hearing aid. The switch on the hearing aid is placed into the 'T' position, and then the hearing aid picks up what the other party is saying by radio waves. This eliminates all background noise for the person, which is a great help. You can spot these phone, as they have the deaf symbol on them (An ear with a line though it). These means that all phone conversations are transmitted from these phones into the air. All you have to do is wear a hearing aid and stand next to the phone, or use a radio receiver. The distance the speech is broadcast is not amazing, but you can normally stand on the phone next to the one in question with your receiver and listen in. 2) You can buy small telephone bugs which can broadcast upto 1500m in FM. These are available from Bull Electrical and cost only about 15 UKP - they are very handy and work very well. Check out www.pavilion.co.uk/bull-electrical for these bugs. What are these strange noises I hear when I'm on the phone? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ People often hear weird noises when they are on the phone. The most common are listed and explained below. Music/Voices: This is either a crossed line (Telcos fault) or you're using a portable phone and you're picking up a radio station. Cracks: A click or cracking noise. Can sometimes interfere with speech, or can just be irratating. Telcos fault. Whistles: Whistling, buzzes or anything like that. Doesn't normally interfere with speech. Telcos fault. Echoing: When you hear your own or the other parties voice a short time after you originally said/heard it. Very annoying and off putting. Telcos fault. Clipping: When you're call is routed through a satellite, and you are not speaking, the line is used for someone else's voice. This saves money for the Telco. When you start speaking again, the exchange finds any empty line and your voice is sent. This takes a short amount of time, and so the start of each sentence is lost (normally the first syllable). This also happens when someone answers their cellular phone, and they say 'Hello' twice. Telcos fault, and there's not much anyone can do. Hissing: Hissing is what you hear when someone is not speaking. When no sound is being transmitted, you hear the sound of the line. In most cases, when the person speaks again, the hissing disappears. Delays: When calling internationally, delays are likely. This means that takes a noticeable amount of time for your voice to reach the other person, and vice versa. Noticeable if you are blue-boxing. Can be off-putting. Delays of more than 2 seconds can cause you to interrupt each other, which was a common problem when we used to blue-box through China. Most other sounds are just the exchange working. If you hear anything else that you wouldn't expect to, email me the details, and I'll see what I can find out. Which payphones can I do 'strange' things with? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Payphones can always be good fun, especially the older ones. My current favourite is the BT Payphone 200 MK II (I have a feeling it is a COCOT: See earlier in this FAQ for details on COCOTs). This phone can be easily persuaded to give you free calls. Description: A creme coloured box with brown cord and handset. Small little LCD screen and nothing fancy. Location: Normally in shops and hotels, swimming pools (No, you fool, not under the water, next to the office!) and so on. May be in a bubble. Anyway, walk up to this phone, pick up the handset and dial *#2580 then the number you wish to call. International calls can be made... he he he. I recommend dropping a coin in, the pressing the receiver switch so the coin drops out but it sounds and looks legit to anyone who is watching. The details from the next one came from a friend called Neil. For Phone with a volume control, try the following: 1) Put in a pound coin, don't worry you'll get it back.. 2) Dial 141141 and then keep pressing 0 many times.. 3) If it works, the phone will says 'no coin call' and will spit your coin back out. 4) If it doesn't work, you've lost a pound. 5) If it does work, make a phone call and BEFORE the money reaches 10 p, press 'follow-on-call'. The dial 14114100000 etc. and you coin will be refunded, hence a free call! What is the likelihood of stealing a payphone? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Some guy asked me if it would be worth stealing a payphone. The obvious advantages are that you can get the money out of it, and also some handy phone parts. I had a look at the standard payphone now (Scotland anyway), and came to the conclusion that it's a fair bit of work to remove one of these large and well armoured looking devils. Even a crowbar across the front of the phone does little damage (except to my fingers!). There is usually a slight gap where the phone is attached to the back of the phone box, so perhaps a crowbar or a little bit of explosive in there might liberate it. But, stand back when it comes off, the phone is heavy and will probably break your toes. If you can gain access to a weaker build of phone, and can easily get away with it, then I say try it. But don't try stealing one in broad daylight in your City Centre! Do all payphones let you send DTMF tones? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A friend of mine in the UK seems to be having problems sending DTMF tones by pressing the keys on the keypad of the phone. Most phones I've seen let you send DTMF tones no problems. Try pressing # once you are connected, then the numbers you want. Some/most payphones seem to play the DTMF sound when you press the keys, but actually dial pulse - strange, eh? It seems that the older types of phones can send DTMF from the keypad, but some newer ones can't/won't. If all else fails, use a pocket dialler or one of those hand-held phone number stores/diallers that send tones for you. How can I make free calls using BT's Chargecard service? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ BT's Chargecard is a little service where you dial 144 then a code, and then the call is billed to your home phone. I decided to get a Chargecard for a little while. The idea is quite good, although BT makes more profit than if you called from home normally! My card started '486' and had another 5 digits then a 4 digit passcode. The only way I know of to make calls for free (although some poor customer has to foot your bill!) is guess the card number at random. This has worked VERY occasionally for me, and is something to do at a payphone for obvious reasons. Just dial 144 then 12 random digits, and the message that follows will tell your if you were successful or not. How old are BT's exchanges? ~~~~~~~~~~~~~~~~~~~~~~~~~~~ I was wondering how old the exchanges are, because in some places the caller id doesn't work. When you try to use it, you receive a recorded message stating that the exchange is old, and BT will be building a new one soon. So, it seems that some exchanges are lovely, new, high-quality (huh!) digital beasts and some still have valves :). BTW, the world's first unmanned phone exchange is in Glenkindie, Scotland, and is very small. How can I make free calls with a Phonecard? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I got the details for this question a few years back from Violator who released a text file about this. Although I can't find the original file, I can remember what he said. So thanx to Violator for this one... Get a hold of your phonecard and some video tape, a pencil, sellotape and some sand paper. (and six thousand tons of sticky back plastic!!!). Now, place a strip of video tape over the back of the card, at the top - this is where the credit details are stored. Sand paper some pencil lead onto the video tape, and then sellotape the whole lot onto the phone card. _________________________ | | Put the videotape over the ###s |#######################| | | | | | 0888672| <- This is the little number that is printed |_______________________| on the back of the card. Now place the card into the card payphone, and hopefully the pencil graphite and video tape's magnetic field should confuse the phone and you should be able to call for free. BT has now released a new type of phonecard which uses a small chip. They use exactly the same design in Malta and many other countries. It may be worth trying a different countries card in a BT phone, and seeing what happens. I also have the technical plans for the chip on these new cards, and as far as I can tell, they can't be 'recharged' - perhaps someone could make new chips which don't lose credits. What is Scanning/War dialling? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scanning and War Dialling are two very similar past times. Both involve dialling many numbers to find something interesting. Scanning is searching for anything like VMBs, PBXs and loops. War dialling is searching for a modem carrier: another computer you can connect to, and see what's there. The term war dialling comes from the film 'War Games' in which the guy sets his computer to dial every number in his home town. Anyway, most searching is done on free call numbers, 0500 and 0800 numbers. There are many good little programs out there which you can set to scan through numbers for you. Over night scanning to 0800 89* *** numbers are always a winner, especially to find places to blue box through. In some states of America, a law has been passed stating that you must not call someone without the intent to communicate with someone. This means that scanning is not allowed there. If your worried about scanning in Britain, use a payphone with a Psion 3a or a laptop with a soundcard. (These are indispensable tools for a phreaker so get your hands on one) I'm worried about being traced, what can I do? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ For a start, 141 doesn't stop traces, it just withholds caller-id. Many 0800 numbers (I've heard) automatically record your number, although I don't know if this is true. You could: 1) Call from a payphone. 2) Call from a cloned cell-phone. I wouldn't worry too much, but don't be over ambitious. Although, I've made over 500 blue box calls around the world from my home phone in the UK and they never did anything. What are some notable things about the UKs phones? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Here are just a few facts you might find useful. After you have finished a call to someone, and they hang up, but you don't, you stay connected. If you don't hang up and they pick up the phone later, you can talk to each other, but of course you are still being billed all the while. This can be useful when you are changing phones in your house, as you can put one down and switch to another. Also, if you want to annoy someone, you could make a free call to them and not hang up, so they'd have to call BT from somewhere to get the call disconnected. I was pondering the idea of making a reverse charges call to someone, getting them to accept the charges and then never hanging up (from a payphone of course) and I wonder if they would charged a lot of money. Remember that reverse charging incurs a sur- charge and costs more per second than a normal call. If you are trying to get through to someone and you think they have taken the phone off the hook, you can actually get through. If you phone the operator and say I need to speak to Jim Smith at Manchester 123456, and that you think the phone may be off the hook, the operator can check. Then she will say that she can send a tone down, so that Jim will hear it and hopefully pick up the phone. When this happened to me (I had knocked the phone off the hook) the operator came on after I heard the tone, and told me that a call was waiting. I then hung up, and a few seconds my friend rang. I hope you find this useful, as I have sometimes. Also, it highlights the possibility of BT having phone tapping capabilities. This new phone has strange buttons, what are they? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ On some phones, non-BT ones, you get strange and unfamiliar buttons. Here are some standard buttons you will see. If you find some more, please email me and I'll try and find out. LR - Last number Redial, calls the last number dialled. S - Silence, temporarily cuts off the mouthpiece completely. R - For use with 3-way conferencing and call waiting. A slider bar on the phone normally changes the speaker volume for people with impaired hearing. A small light could mean in use, or could flash when the phone rings, again for those with impaired hearing. What have people done in the past? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Some friends and myself thought of a good way to make money about 2 years ago - setup an 0891 number and then make heaps of fraudulent calls to it, and rake in the cash. In fact this idea works - I read a few weeks ago about some people in London a while back had done this, and had a room with 20 clones cellphones connected to their number - they got away with a large amount of cash. I see no reason why this still can't be done. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ That's the end - if you have any questions, please do email me with them. pyro-teknik@geocities.com or pteknik@spasm.redcat.org.uk --