Suppose I have a prepaid public telephone card containing £5 in it. Now I connect this card to my laptop and figure out where in the card £5 is stored. I then change this to £5000, and leave the rest of the card untouched.

Wouldn't this modification allow me to make many calls for the total cost of £4900, even if originally I could have only used £5?

  • 16
    IDK how this all works, but if it's implemented securely, the card itself just contains a unique identifier and the value is stored on a server somewhere. – Alexander O'Mara May 6 '16 at 19:12
  • 1
    I believe a prepaid phone card is more like a license key. The company who produces the cards has a list of all cards that exist, along with denominations. When you purchase it, there are certain protocols that are typically triggered that "activate" that card for use (same reason why stealing a bunch of them won't give you free time). When you use it, it likely asks a server somewhere if it's activated, if it's allowed to be used, and if the balance remaining will suffice for the call. – user64273 May 6 '16 at 19:13
  • 4
    In the eighties in France (and probably other countries) where were smartcards for use in public phones. They "contained" 50 or 120 "units" and were not refillable. Every time a unit was consumed, "something" was irreversibly destroyed in the card itself. There was no way you could pretend you had more units, or at least no way that was cheaper than buying a new card. See also en.wikipedia.org/wiki/Telephone_card#Stored-value_phone_cards – Stéphane Gourichon May 6 '16 at 19:31
  • 5
    @StéphaneGourichon The "something" is usually an antifuse. They start out non-conductive and their state can be sensed with a low voltage at limited current. They can be "blown" by applying enough voltage or current, which makes them conductive. This is a permanent operation, and it's often used in microcontrollers and PROMs to permanently set a certain flag (e.g. write-disable). – Polynomial May 6 '16 at 21:20

Back in the 90s these prepay cards were easily hacked in a number of ways. First, as you said, people could reprogram them with much larger amounts for free calls. A more low-tech method was that they'd simply scratch off or cover the conductive surface on the pin which decreased the amount on the card, allowing for infinite free calls on a one-time topup. These systems are now almost universally obsolete.

Modern prepay cards usually use one of two methods.

In some cases they'll contain just a numeric identifier (ID) and your balance will be maintained on a remote server, which is the case with many MAN systems. These are usually the most secure, but they have a downside: you need continuous connectivity between the phone system and the remote server.

However, in some scenarios (particularly remote areas with poor infrastructure) the validation can't be done against a remote server. Instead, the prepay card is a smart card (similar to a SIM) with certain functions exposed. Each function requires a different access key. One function is "charge an amount to the card", and the key for this is present in a payphone box. However, this key can't be used to access the "add funds to the card" function, which is only accessible by top-up devices in stores. The keys in top-up devices are kept in tamper-sensitive systems, similar to how chip & pin machines work. The actual amount value on the SIM is kept in an encrypted form within a tamper-proof EEPROM (or similar), with an authenticity record maintained using a key pair deployed in the phones and top-up machines. Attacking these is very difficult, but potentially possible if you compromise a top-up machine.

  • Reminds me of the old saying that casinos with faulty slot machines (that pay out too much) are no longer in business. – Michael May 7 '16 at 1:54

I will answer this although it seems to be worded sketchy. Calling cards, and credit cards do not work in a manner as you infer/interpret. In a calling card system, especially pre-paid cards, when you make a call it works like this:

You --> call pre-paid number to enter a PIN
PIN System --> you "What is your PIN #"
You --> enter your PIN
PIN System --> let me check this PIN against my DB and see how much money is available

As described above, the calling card is nothing more than an identifier (PIN) that gets authenticated (Calling card number you call), then a determination is made based on that PIN: "We used that specific PIN as a pre-paid $5.00 calling card... Caller used X amount of minutes. "Enter the number you wish to call" (this is how many minutes you will have to make this call)"

Most calling card platforms have since moved over to either entirely VoIP, or a hybrid combination (VoIP + POTS lines) since it is cost-effective, and generates more revenue. Many of these PIN/calling card systems sit behind an SBC (Session Border Controller) that have controls in place to detect fraudulent activity. Aside from that, let's look at the "security" via way of legalities of what you are asking for...

Assume you could "program" a card and add money. Don't you think, that at some point in time, an organization won't notice the discrepancy based on the amount of calls you made? You would make it easier for authorities to track you since they would have the numbers you called, and the number you are calling from. For anyone not familiar with telephony, do not think blocking caller ID would help you. (That description/wording is for another question (ANI, CNAM, CID, LEC, ILEC, CLEC))

  • 1
    Really good answer. I've only added a second answer to cover off some other options and the oldskool 90s phreaking anecdote! :) – Polynomial May 6 '16 at 19:25
  • @Polynomial the good old days (90s). I remember in the 80s and 90s, "calling cards" usually corporate ones were rampant. The PIN methods' sequences were so easy to 'break' usually the last four were the different numbers while many remained the same (Sprint FON). I wanted to add more, but it would have been overkill (FSK, CLIP, PRI stuff). – munkeyoto May 6 '16 at 19:30

What the provider is looking out for are duplicates of pin in activated {pin,phone} tuples. The billing information from the telco to the company would indicate also show discrepancies between phone to credit usage when pin duplicates are observed. That's when you know who the culprit is. The only problem is: with low usage or a large enough pool such that collisions between fictitious pin vs legitimate numbers are low, the duplicates are rare. So the numbers are released in regulated tranches and when a non legitimate pin is found, the number is flagged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.