The Remarkable Evolution Of Toll-Free Numbers (Fall, 2008)

It’s hard to believe that another summer has already passed. However, the stages of photosynthesis are drawing to an end here in the Pacific Northwest, at least with the deciduous trees. These have turned brilliant shades of yellow, orange and red along the North Cascades Highway. It’s truly one of the most incredible drives in the country, even when you’re an outside plant technician winding your way toward the latest downed aerial cable. Don’t forget your icky-pic!

Anyway, it’s after midnight here in the Central Office, and I’m watching an infomercial on YouTube. This particular infomercial is for the Ronco Dial-O-Matic, which I’m disappointed to report is not a telephone. Quantities are limited, (I’m sure that’s true), so I’m being urged to call 1-800-486-1806 right away! Operators are standing by!!!

This is not a phone.

This is not a phone.

Well, have you ever wondered what actually happens when you pick up the phone and dial a toll-free number? Yes, I know, a robot or someone in India answers, but have you ever wondered what’s happening on the network side?  Well, don’t let this opportunity slip away! Grab your phone and get ready to dial right away, because we’re taking a trip to SMS/800.

Ha. Fooled you! We’re not going anywhere without a history lesson first. AT&T first invented toll-free 800-number service in 1967. Businesses frequently complained that customers were less likely to contact them if they had to place a long distance call. At the time, there was a toll-free system called the Zenith system, where you could dial an operator and ask for a “Zenith” (or sometimes “Enterprise”) number, but this was inefficient because all calls were operator assisted. Collect calls were another option, but as with Zenith numbers, these were also operator assisted. In response, AT&T defined the 800 NPA, and began offering “In-WATS” service. This offered a huge advantage: calls could be direct-dialed. Switches were programmed to, in effect, bill calls to these numbers as collect calls, but seamlessly to the user.

The early WATS system was rudimentary, and required separate toll-free numbers for intra-LATA versus inter-LATA calling. This often meant that nationwide toll-free numbers didn’t work throughout an entire state (Nebraska was often a problem, as many call centers were located there). Over time, the system became very popular, especially with phreaks who treated toll-free numbers as an on-ramp to the long distance network. They’d call a toll-free number on an analog exchange, then blue-box onward from there. Incidentally, until a few years ago, you could still do this with country direct numbers still using C5 signaling. Maybe you still can. But I digress.

In 1984, with divestiture, the FCC granted other carriers the ability to offer toll-free service. To make this work, specific NXXs were assigned within the 800 NPA to each carrier. The tandem switch was then able to route calls to the appropriate network. Unfortunately, this created a problem. If you wanted to change toll-free carriers, you couldn’t, because your number was locked to a specific carrier. As you might imagine, this largely took away incentive for carriers to provide competitive rates and service, particularly for owners of vanity toll-free numbers (such as 1-800-FAT-GIRL).

In 1991, the situation came sufficiently to a head that the FCC ordered that toll-free numbers become portable. This was, incidentally, the first FCC order requiring number portability, although the FCC has subsequently ordered local number portability (which allows you to port wireline numbers between wireline carriers), wireless number portability, and wireline-to-wireless number portability (note VoIP carriers are treated as wireline carriers for purposes of local number portability). Curiously, you still cannot port a wireless telephone number to a wireline or VoIP carrier, but again, I digress. Hey, it’s my union right with this much seniority!

The FCC order proved to be a genuinely significant technical undertaking, and it wasn’t until May, 2003 (after one short extension) when you were finally able to port your toll-free number. And thus was born SMS/800, the national toll-free service bureau. This service bureau is responsible for, among other things, tracking RespOrgs (long distance carriers and others who sell and/or bill toll-free service) and providing toll-free number reservations to these RespOrgs.

SMS/800 logo

When you want to reserve a toll-free number, your telephone company (RespOrg) checks with SMS/800 to find out what numbers are available. Toll-free numbers are currently available in the 800, 888, 877 and 866 NPAs. The 855 NPA is not currently in use, but will be the next toll-free NPA brought into service. Once you and your carrier identify a toll-free number that you like, and presuming that your carrier is scrupulous (many aren’t, and this is a whole can of worms I won’t open right now), they will reserve it on your behalf and transmit your subscriber information to SMS/800 as required by FCC regulations. SMS/800 associates the toll-free number with the PIC code of your carrier and (usually) the NPA-NXX-XXXX to which it is routed. This information is then replicated to the Service Control Point (SCP) databases, which are located strategically (and redundantly) at various switching facilities around North America.

It’s important to note that you are legally the owner of your toll-free number, and not your long distance carrier. Regardless of billing disagreements with your carrier, contract disputes, or whatever else, the number belongs to you, and you can transfer it to any other carrier you like, anytime you like. Unscrupulous individuals or companies can use this rule to their illicit advantage by switching carriers frequently and skipping out on the bill.

So, what happens after your number is set up, and someone calls it? SS7 initiates a database lookup routine, which is a fairly complicated and not particularly interesting process. Based on the results of the database lookup, your call is routed to the long distance carrier servicing your toll-free number, which routes your traffic over the network—for the most part—as an ordinary long distance call. Except you get the bill, instead of the person calling you.

There are a few things that are very different than a normal long distance call, however. First and foremost, when you dial a toll-free number, the person you are calling is paying the bill. This means that they have a right to your ANI, which is generally your phone number. So, when you call up Ronco to order a shiny new Dial-O-Matic, they have the phone number you’re calling from. Furthermore, once you place an order, they magically have an established business relationship with you, so they can bother you almost any time they like. And if this wasn’t bad enough for privacy, it gets worse. Many carriers don’t wait until they send the bill to send your number. For example, my toll-free service provider translates the ANI of anyone calling me to Caller ID data, so I receive it in realtime. Even if someone blocks their caller ID, I still get their number when they call me. So, the lesson here is that while it’s never a good idea to assume you’re anonymous over the phone, it’s an especially bad idea when calling toll-free numbers.

When you call a toll-free number, in theory, the person you’re calling pays the bill. In fact, the FCC rules are very clear on this point: you cannot legally be billed for calling a toll-free number. This doesn’t stop unscrupulous providers armed with ANI data, though. Phone sex lines love to engage in the practice of “cramming” your bill with extra charges, and even AT&T has engaged in the practice of “back-billing” fraudulent third-party billed calls to the originating number.

The FCC rules allowing easy number portability have led to vulnerabilities that have occasionally been exploited by phreaks. For example, when companies acquire one another, they sometimes disconnect the land lines of an acquired company, but forget to switch off the toll-free numbers. This is particularly common when laying off the PBX administrator before winding down the operation (and seems to happen with startling regularity). Phreaks with a well-tuned ear can recognize the difference between a long distance company disconnect/invalid intercept and a LEC-generated one. As a phreak, if you dial a toll-free number and receive a LEC-generated intercept, you have potentially struck gold because a neglected toll-free number is ripe for either rerouting or porting to a different carrier. Using a technique called pretexting, phreaks have occasionally run up phone bills in the high 6 figures by rerouting toll-free numbers to conference bridges and similar nefarious destinations. They’ve even ported the numbers to other carriers, resulting in the same scenario repeating over and over again. Carriers try to prevent this by introducing bogus technical obstacles to porting numbers where fraud is suspected, but these measures are largely ineffective (by FCC design).

And with that, it’s time to bring another issue of The Telecom Informer to a close. I feel a sudden urge to audit my employer’s toll-free number pool! Drive safely in the rain as the days become ever shorter. And when you pick out your Halloween costume this year, consider a Bernie Ebbers mask as part of the ensemble!

References – SMS/800 service bureau – Detailed write-up and logical topology diagram of SS7 database lookups