Does Someone Have Your Company's Number?

When Linda N. Paris opened the August, 1989, phone bill for Philadelphia Newspapers Inc., the telecommunications manager was stunned. On a single day, more than 6,000 calls had been placed from the telephone switch that serves the company's two papers, the Inquirer and the Daily News, to numbers in Pakistan, Egypt, and the Dominican Republic--places Philadelphia reporters rarely call. During the month, such calls added up to about $90,000--nearly a quarter of the Knight-Ridder Inc. unit's entire phone bill.

Philadelphia Newspapers was a victim of a relatively new high-tech crime wave: PBX fraud. By stealing numerical passwords, thieves can tap into corporate switchboards, known as private branch exchanges, or PBXs. Once inside, they can dial anywhere--on the victim's tab. Often, the culprits are drug dealers, who use PBXs to place hard-to-trace calls. Others are shady entrepreneurs, who sell the access numbers on the streets, usually to immigrants who can't otherwise afford to call home. By the time a PBX owner realizes what's going on, there's not much chance of tracking the criminals down. "I doubt we'll ever find them," says Paris of the Philadelphia PBX hackers.

HEAVY TOLL. Dozens of companies have been hit, including Procter & Gamble, Sumitomo Bank, and Christian Broadcasting Network (table). The cost to companies could be as high as $500 million annually, estimates Rami Abuhamdeh, executive director of the Communications Fraud Control Assn., a group of phone companies and law-enforcement officials. Abuhamdeh concedes that accurate loss estimates don't exist but says: "This is one of the fastest-growing problems in the communications business."

Toll-call fraud itself is nothing new. Since the 1960s, for example, college students have circulated stolen calling-card numbers. But computers at American Telephone & Telegraph, MCI, and U. S. Sprint now alert security officials to suspected card ripoffs in as little as two hours by spotting unusual usage. And new technologies have rendered useless the "blue boxes" that "phone phreaks" once used to place free calls by mimicking the tones of network switches.

The corporate PBX is one of the last weak links. Hackers start by finding the toll-free 800 number of a particular PBX. Then, they determine the code that an employee away from the office uses to place a long-distance call through the switch. According to law-enforcement officials, some thieves obtain 800 numbers and passwords by spying on executives using pay phones. Others, known as "dumpster divers," ransack garbage for numerical keys to the switching systems. Some hackers use computer programs that try thousands of numbers until they hit working passwords. For kicks, they sometimes post them on electronic bulletin boards.

EVASIVE MANEUVERS. Thieves who sell the codes are a bigger problem. "Call-sell" operations, run from pay phones or out of apartments, offer illegal toll calling for a cash payment. Security officials at MCI Communications Corp. say that call-selling began in New York City but in the past year has spread to Los Angeles, Chicago, and other cities. Last April, MCI led investigators to a man and a woman in upper Manhattan whose call-sell operation ran up more than $178,000 in charges to unwitting companies. They pleaded guilty last fall to state grand larceny and computer-trespass charges.

More often, though, the lawbreakers disappear without a trace. To evade detection, they use a technique known as "looping." They break into one PBX, but instead of dialing the final destination from there, they tap into a second PBX and then complete the call. That makes it harder to track the caller. Even if they're caught, PBX hackers usually get off lightly because judges don't regard such fraud as a major crime. The two operators in New York were sentenced to perform community service.

Long-distance carriers are working with customers to keep PBX fraud from spreading. MCI has sent security tips to 250,000 corporate customers. It suggests lengthening passwords, to make them harder to figure out, and blocking the PBX from making international calls if employees have little need to make them. Another tip: Shut off remote access to the PBX during nonbusiness hours.

Customers have good reason to adopt preventive measures. So far, courts have ruled that they're liable for the charges, even if their employees didn't make the calls. However, some companies have persuaded carriers to forgo charges for the stolen calls. Christian Broadcasting Network, which in 1987 was hit with $40,000 in fraudulent calls, "hasn't paid MCI anything," says Paul D. Flannigan, CBN's vice-president for information services. "I expect it to stay that way."

Still, most customers have no idea how vulnerable they are to PBX fraud, carriers say. That means there is a flock of corporate pigeons ready for phone thieves to pluck.

      Victim              Fraudulent charges
      New York City Human
      Resources Administration       $704,000
      Procter & Gamble                300,000
      Sumitomo Bank                    97,000
      Philadelphia Newspapers          90,000
      Tennessee Valley Authority       65,000
      Christian Broadcasting Network   40,000
Before it's here, it's on the Bloomberg Terminal.