A Night in the Life of a Telephone Hacker

By Jon Hallberg, US Federal Credit Union
May 5, 2005

This is a fictitious, but all too real story, from the hacker’s point of view. . . .

It’s 2:30 in the morning and I’m a bit bored, so I started dialing some numbers. The local credit union has a phone number that ends in 1000 so I start dialing 1001, 1002, 1003, etc. When I get to 1021 I find a voice-mail box for Bob Jackson in accounting. It says he will be on vacation until next week. I keep dialing. . . .

After a few minutes I get bored of listening to the same old voice-mail greetings and fax tones. So I try to spice it up a bit. I check my notes, and call Bob’s voice-mail back and hit STAR, but nothing happens. Then I hit # Pound. I hear that lovely electronic goddess call out, “Please enter your password.” I quickly enter 1021 (Bob’s extension)—nothing happens. Then I try 1234 and Bingo! Bob like many others out there, has not been too creative with his voice-mail password.

“You have 27 new messages and 35 saved. Press 2 to hear new messages,” she says in that monotone drone. I press 2. “Hi Bob, It’s Jim in the service center, hope your having fun on your vacation. When you get back into the office can you have a look at account number 6783277? Mr. Smith called me and said his wife bounced a check as her payroll deposit came in late. Could you call them before their next payroll comes around? Their telephone number is 555-555-5555.”

Well that was easy, and on the first try at that! A quick check of the reverse telephone directory tells me that 555-555-5555 belongs to Ted and Betty Smith, 124 South First Street. I have an account at the credit union. Ted and Betty have a checking account and direct deposit. Knowing Bob from accounting is on vacation, let’s give Betty a call tomorrow. J

The Next Day. . .

At 9:15 a.m. from the payphone at Perkins I dial 555-555-5555. It rings. . .

Mrs. Smith: “Hello?”

“Hello, Betty Smith, please.”

“This is Betty.”

“Hi Betty, this is Bob from the credit union. I just wanted to call and let you know that we reversed the overdraft fee on that bounced check. Additionally I wanted to see if we could figure out why the direct deposit didn’t come in correctly. Do you have a moment?”

“Sure,” says Mrs. Smith.

“I’m just pulling up your account now (pause). Mrs. Smith, my system is running a bit slow today, let me look it up differently, I’m sorry for the wait. Who is your employer?”

“Acme Office Furniture.”

“Okay, here they are, but there are few older listings here, too. What is your social security number?”

Mrs. Smith: “777-777-7777.”

“Okay, here you are. Everything looks setup okay. Wait! That’s pretty strange. I see that there may be a routing issue here between your employer’s account and our institution. They may have changed accounts or banks. Can you have your HR department contact us so we can verify that their account information is correct? As long as they call before your next payroll everything should be fine. Once again I’m sorry for the inconvenience, and thank you for your time, Mrs. Smith, I’m glad we got a closer look at this one.”

Mrs. Smith: “Me too. My payroll should come in on time next Tuesday right?”

“As long as they give us a call with their information it shouldn’t be a problem.”

Mrs. Smith: “OK. Goodbye.”

“Have a nice day.”

Well now Mrs. Betty Smith (husband Todd) who lives at 124 South First Street is ready for a new credit card!

Although the above scenario seems a bit hard to believe—believe it!

It takes very little information in today’s digital age to make a mountain from a molehill. Not only by dialing for random targets did Bob’s voice-mail turn up, but so did a whole bunch of fax numbers.

After knocking on the doors of Betty’s neighbors, pretending to be selling satellite TV service at a price way higher than the competitor (nobody would be interested in asking for details), I find that the Smith’s neighbors aren’t home during the day.

I go to the local coffee shop with free Internet kiosks (I needed a grande double mocha latte anyway). As I sip that ambrosia I slip online to download some check reorder forms from the credit union’s website. Because they don’t have a printer at the coffee shop, I go to Kinko’s to print it out and fax it in. I updated a few things like the address (now 127 South First Street). It says on the reorder form “seven to ten business days to delivery,” so I should start checking the 127 South First Street mailbox in about five.

On Day 4, armed with fliers for the local church down the street that I picked up off the counter at the convenience store on the corner, I drive up to the box. Opening it up and placing a flyer inside I don’t see anything yet. Tomorrow it will be coupons for Pizza Hut taken from the morning paper.

You get the point. Within a week Mrs. Betty Smith will have a whole lot of checks to account for starting Tuesday (when her payroll comes in). This simple scam will start paying real money.

Jon Hallberg is network telecom manager for US Federal Credit Union in Burnsville, Minnesota. Contact him at Jon.Hallberg@usfed.org.