¶2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ¶3 THE BIGGEST PHONE FRAUD IN EUROPE ¶2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx By Erik Løvendahl Sørensen ¶1In an idyllic little town near Silkeborg in Denmark lives "Mr Banditt", as he is called by his friends, a young 19 year old manwaiting to appear in court, accused of having abused the telephone system and telephone credit cards, known as "calling cards", to a value in excess of $ 10 million. ¶3ONE OF THE HACKING WORLD'S TOP FIGURES ¶2-------------------------------------- ¶1Denmark has had several cases of telephone abuse and hacking in recent years. Two examples: the Danish hackers Jubjub Bird and Spockets have been discussed a great deal in the Danish media; and then there is the BBS case from Copenhagen where the owner of one of Denmark's best known Bulletin Boards "Valby Amiga BBS"waits for the high court's verdict. Common to these cases is that the police up to now had only caught the small fry. ¶3 POLICE CLAMP DOWN ¶2-------------------------------------- ¶1In the meantime, on March 12th this year the police got one of the really big fish "hooked". A house search was undertaken after a long lasting surveillance of the involved person's telephone conversations and mail. ¶3 THE RESULT ¶2-------------------------------------- ¶1The police investigation has now finished, after several hours' work and the result is shocking. They believe that they can prove that Mr Banditt, with the rather more normal first name "Kristian" has swindled the American phone company AT&T out of several hundred thousand dollars. How many hundreds of thousands will be impossible to evaluate exactly. The swindle has also been perpetrated in Denmark, where Mr Banditt has phoned free by illegally using a phone belonging to Aalborg local council. Mr Banditt has distributed more than 1500 stolen "calling cards" around in Europe. A large number of the cards were sold for $100 monthly subscription to a number of regular customers around Europe. The recipients have thus had the chance to phone without paying by using these cards. It is there- fore possible that the case is of even greater extent, and that the real numbers relate to around 5000 "calling cards"; but in these technical cases the police often find it hard to map out and clear up all the sharp tricks which the hackers use. When one is talking about stolen calling cards, it must be mentioned that it is not the actual cards which are stolen, but the pin codes and the other information which are necessary to use the cards. How does one come to the sum of $10 million? It is alleged that every single card can be used for an average of 60 hours and the cards are mainly used for phone conversations to the USA which cost nearly $2 per minute. Yes, all in all, then one comes to this gigantic sum according to Danish calculations. ¶3 THE ACTUAL METHOD USED ¶2-------------------------------------- ¶1It doesn't require great talent to cheat the phone companies and, in the long run, the subscribers. In this case one of the simplest standard methods, the con artist method was used. This method requires the telephone subscriber being phoned by someone who introduces himself as from the phone company's safety depart- ment. One is asked one's name, if one has a calling card, because an unusually large sum has been withdrawn from the card in the last 48 hours. The subscriber claims that he hasn't even used it in that period. The con man asks the subscriber to find the calling card so that he has it in his hand. They chat to and fro, and a little later the con man offers to run through the customer's whole account and send a new card within the next 3 weeks. (The customer is very happy with this, because his own phone calls will be cancelled at the same time). There is no reason to follow the conversation any further. In hacking circles instructions circulate (we hav e an example here in editorial). These instructions describe in detail how one tracks down the victim and then "pump" him for his pin-code. (The first number is the subscriber's phone number, which the trickster already has). Unfortunately many people let themselves be cheated, when the con man uses the right questioning technique. This calling card number which is been swindled out of the poor subscriber can now be used by the swindler for a month before either the subscriber or the phone company suspects anything and stop the abuse by closing down the account. ¶3 EVEN A PROFESSIONAL CAN GET CAUGHT ¶2-------------------------------------- ¶1One can guess how Mr Banditt was found. The notification to the police in March was carried out by the Telegraph Inspector Peder Poulsen from "Telecom Denmark", so one could reckon that it was a tip from the USA which led to the case. Freddy Hansen from Telecom Denmark reports that they are regularly contacted, both at home and abroad, and also from private customers about the abuse of foreign phone calls. Unfortunately in only a few cases has there been any success in tracing the abuse and getting the swindle stopped. Mr Banditt believes himself that he was caught because, in his over-con- fidence he broke one of the hackers' unwritten rules by illegally using a Danish PBX phone at the "Aalborg Elderly Handicapped Research Centre" for a considerable length of time. (A PBX phone is one where calls can be passed on from outside to another number and where the phone caller themselves does not actually pay for the call.) These phones are often used by sales people and the like. Then the bill maybe finally arrives and the subscriber naturally contacts the phone company because the bill is suddenly so enor- mous. The phone company sniffs around a little on the subscriber's lines and suddenly the trap shuts. ¶3 THE PUNISHMENT ¶2-------------------------------------- ¶1"The court case is not finalised, but will probably be in September - Octo- ber 1992,"(This article is pretty old... -Ed) informed chief constable Paul Kühl in Denmark, "but it will be interesting to hear the sentence because nothing tangible has been stolen (if that was the case, the law would have been considerably stricter) and therefore one must expect a suspended sentence because the man has no previous convictions." Telephone fraud in the USA is estimated costs about $5 billion annually so we are not just worrying about small change. Small groups of immigrants gather on street corners, in subways and in coffee bars around with a dealer who, for around $10, can "get you a 2 hours phone call home to Italy or Poland". The United Nations alone is defrauded of around $1 milliard annual-ly, NASA and IBM come in at second place because they are defrauded of around $1/2 milliard annually. The American phone company is thus being systematically milked and with an efficiency and extent which can only be surpassed by the American whisky hooch gangsters from the days of prohibi- tion in 1920's America. The phone company AT&T's profit is droped 84 % this year, you maybe now know a little about why? Many young students in the USA find it totally natural to "cheat" free phone calls on the phone network. They did not consider it a crime because, as they say "the phone network is there anyway, we just make sure that it is used more efficiently." This attitude has also spread to Europe where maybe every other computer-interested high school student has either them- selves accessed illegally into a free phone line or knows someone else who does. ¶3ARE CREDIT CARDS BEING USED ILLEGALLY? ¶2-------------------------------------- ¶1There are also an innumerable number of account cards in the USA; one almost measures an American's status and success on the basis of how many account cards he has. The really tough guys can often present a row of cards a yard and a half long or more. The same methods as described with "calling cards" are also used by the swindlers on ordinary bank credit cards like, for example, Visa cards. It is, however, much more seldom, but the amount of talk about these cards in hacking circles indicates that a certain amount of abuse and fraud happens also where these cards are concerned. The police are only aware of, by and large, rumours. One cannot depend on information from the police being of great reliability with regard to this type of fraud since it is a well known fact that they see only the top of the iceberg. Information about hacking or fraud concerning Visa cards is preferably a rumour one only hears about third hand. In a single episode, a couple of months ago, I met a computer specialist who held the same mistrust of these stories as I do. Whil e he was working for an American network, a hacker suddenly logged into the network. They talked a bit about hacking and various forms of fraud. The hacker discussed, while they were talking, how easy it was to use credit cards illegally, eg. Visa cards. When the hacker's story was rejected as being just so much hot air, the hacker got rather pissed off and finally said: "Now you can see on your own card, I'm going to take one dollar off your card's account on the 15th of the month." It actually happened! ¶3 WHO PAYS FOR THE MISUSE? ¶2-------------------------------------- ¶1Up to now it has been the practice of the US telephone companies that customers, who have been victims of misuse avoid paying the bill. This has recently changed because several young student computer freaks have abused the system and have "lent" their calling card numbers to their computer pals in Europe. This was because the phone company always dropped demand for payment when it came to the crunch, so there was no risk in letting someone else use the card. Now this gap has been plugged so that the phone company AT&T only drops demands for payment in a single instance. If the abuse happens several times on a subscriber's calling cards, then there's no fairy godmother to help out. The money has to be handed over - cash on the table. In Europe the telephone companies practice a significantly tougher line because they have no general rules. A number of cases where the subscribers have been confronted with a phone bill in the region of 10-50 times their normal size have been talked about in the daily papers. ¶3 ARE THE PHONE COMPANIES FAILING ? ¶2-------------------------------------- ¶1In recent years there have been many cases mentioned in the press about people who have had incomprehensibly large phone bills. In most cases the people's complaints are refused and there have been examples of pensioners who had to pay a quarterly bill of around $2,500, or have their phone cut off. Is there something in it? Maybe there is something in all this talk? Is the technology at fault, or what? It has become a "national sport" of the immigrants and refugees to be able to cheat a phone call home to Italy without paying, or wherever they come from. There are several methods to cheat yourself a free call, maybe 6-7 different methods. Common for most of the methods is that it ends up with someone else footing the bill for the "party". There has been heated debate about the phone companies' new service numbers, the so called "sex lines" or 900 numbers. It is a fact today that there has been comprehensive abuse here, and it is hard to imagine that an 80 year old lady should have used $2000 to $3000 to get canned sex over the phone. The last category of telephone abuse is what is known as "data abuse", where young computer freaks "get hold of" free phone lines so they can hack into large private or public data-networks. In the most cases they only do it to prove that they can crack the passwords and bypass other security devices. Only exceptionally is it to steal or destroy data information. ¶3 YOUR OWN RESPONSIBILITY IN DENMARK ¶2-------------------------------------- ¶1According to Christian Voetmann from the legal department in the Danish phone company KTAS, the company recognizes the problem of telephone abuse, but deny that they can generally let people off their phone bills. Only in very rare cases, where it can be proved that the equipment has been faulty or "got at" will one be let off a phone bill. Christian Voetmann says that people should especially be aware that the phone company's responsibility stops at the extremity of the monopoly, ie a person's house. Thus if the customer's equipment is a cordless phone, switchboard or any similar indoors equipment, these are not within KTAS's area of responsibility. The responsibility is solely that of the user. There have been several examples in Denmark of the abuse of what are known as PBX systems, where the hackers have abused the phone lines. But Christian Voetmann maintains: "People have bought their equipment outside KTAS, so we absolve ourselves of any responsibility for abuse." This position can lead to interesting perspectives. There have been a couple of examples of break-ins recently, where the police investigation has proved that the burglar had apparently broken in to use the phone free. In such cases both the phone companies and the insurance companies have refused to pay the people's bills and the customer alone has to bear the pain and delve into his own pocket. ¶3 INCITEMENT FROM THE PHONE COMPANY? ¶2-------------------------------------- ¶1The methods of abuse, fraud and the like change and alter at the speed of light following opportunities which arise when new technology is introduced. Cunning people exploit the loopholes in the new technology. One tries to block opportunity for abuse and the like. People who don't like paying tax and prefer to think creatively can be stopped by blocking the loopholes in the taxation laws, but new loopholes open all the time. Yes, in the same way that it has become a national sport to cheat on their taxes, if people can get away with it; many young people feel the same way about the new technology in the data world. It has become a challenge, and it has to be bloody well beaten. One cannot deny either that the young computer-mad people are incited to it when they read or hear on the TV that this or that is 100% secure and cannot be abused. It is clear that if one wants customers for every type of account card, then one should tell these customers that their money is secured by the best means against abuse. But this can so easily be exaggerated that it approaches incitement to abuse. Certain phone companies in the USA, but also truthfully in Europe, have experienced that transmitting "official" speeches about their security has led many hackers and the like to prove the opposite, because they know that what was being officially said in the media was actually a lie. The moral: "If you can lie, then we can cheat, and the two are unfortunately not very far apart".