Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Suppose I have a prepaid public telephone card containing £5 in it. Now I connect this card to my laptop and figure out where in the card £5 is stored. I then change this to £5000, and leave the rest of the card untouched.
Wouldn't this modification allow me to make many calls for the total cost of £4900, even if originally I could have only used £5?
Back in the 90s these prepay cards were easily hacked in a number of ways. First, as you said, people could reprogram them with much larger amounts for free calls. A more low-tech method was that they'd simply scratch off or cover the conductive surface on the pin which decreased the amount on the card, allowing for infinite free calls on a one-time topup. These systems are now almost universally obsolete.
Modern prepay cards usually use one of two methods.
In some cases they'll contain just a numeric identifier (ID) and your balance will be maintained on a remote server, which is the case with many MAN systems. These are usually the most secure, but they have a downside: you need continuous connectivity between the phone system and the remote server.
However, in some scenarios (particularly remote areas with poor infrastructure) the validation can't be done against a remote server. Instead, the prepay card is a smart card (similar to a SIM) with certain functions exposed. Each function requires a different access key. One function is "charge an amount to the card", and the key for this is present in a payphone box. However, this key can't be used to access the "add funds to the card" function, which is only accessible by top-up devices in stores. The keys in top-up devices are kept in tamper-sensitive systems, similar to how chip & pin machines work. The actual amount value on the SIM is kept in an encrypted form within a tamper-proof EEPROM (or similar), with an authenticity record maintained using a key pair deployed in the phones and top-up machines. Attacking these is very difficult, but potentially possible if you compromise a top-up machine.
I will answer this although it seems to be worded sketchy. Calling cards, and credit cards do not work in a manner as you infer/interpret. In a calling card system, especially pre-paid cards, when you make a call it works like this:
You --> call pre-paid number to enter a PIN
PIN System --> you "What is your PIN #"
You --> enter your PIN
PIN System --> let me check this PIN against my DB and see how much money is available
As described above, the calling card is nothing more than an identifier (PIN) that gets authenticated (Calling card number you call), then a determination is made based on that PIN: "We used that specific PIN as a pre-paid $5.00 calling card... Caller used X amount of minutes. "Enter the number you wish to call" (this is how many minutes you will have to make this call)"
Most calling card platforms have since moved over to either entirely VoIP, or a hybrid combination (VoIP + POTS lines) since it is cost-effective, and generates more revenue. Many of these PIN/calling card systems sit behind an SBC (Session Border Controller) that have controls in place to detect fraudulent activity. Aside from that, let's look at the "security" via way of legalities of what you are asking for...
Assume you could "program" a card and add money. Don't you think, that at some point in time, an organization won't notice the discrepancy based on the amount of calls you made? You would make it easier for authorities to track you since they would have the numbers you called, and the number you are calling from. For anyone not familiar with telephony, do not think blocking caller ID would help you. (That description/wording is for another question (ANI, CNAM, CID, LEC, ILEC, CLEC))
What the provider is looking out for are duplicates of pin in activated {pin,phone} tuples. The billing information from the telco to the company would indicate also show discrepancies between phone to credit usage when pin duplicates are observed. That's when you know who the culprit is. The only problem is: with low usage or a large enough pool such that collisions between fictitious pin vs legitimate numbers are low, the duplicates are rare. So the numbers are released in regulated tranches and when a non legitimate pin is found, the number is flagged.
