Deciphering Tracfone (Spring, 2010)

Hello, and greetings from the Central Office! I’m bundled up, have an electric heater at my feet, and a cup of tea on my desk. Yes, folks, it’s cold and flu season, and I have one or the other of them. Maybe both. It doesn’t matter, though—the company is paying a perfect attendance bonus this month, and all I need to do is make it through at least half of my shift! Outside my Central Office, we have a coin station. It’s an old Western Electric 1D2 set, and it was configured to allow incoming calls until last week. A few months ago, it became one of the busiest coin stations in the city. A shady-looking teenager would hang out all night on Friday and Saturday taking lots of very short incoming calls. A few minutes later, a vehicle would roll into our parking lot, he’d step inside to do business, and then the young entrepreneur would return to his “office.”

An office phone... of sorts.

An office phone… of sorts.

For months, this didn’t bother me. After all, incoming calls generate revenue for the company, the business activities never caused me any trouble, and it made for interesting “service monitoring.” All of that changed last week, though, when a white Camaro pulled into my parking lot at high speed. Squealing tires, skid marks, and the stench of burnt rubber hung in the air… and then the driver did the unthinkable: he burned a donut in my parking lot! Well, that was it. The next morning, my long-neglected coin station had new signage: “OUTGOING CALLS ONLY” – and my young acquaintance moved his business to the mini-mart across the street. His new “office number” became a Tracfone, telecommunications provider to the underworld.

If you have bad credit, run a not-quite-legal business, or are an illegal immigrant, Tracfone is designed for you. No credit checks or identification is required. Better yet, the service is totally anonymous and can be paid for with cash! Owned by Mexican billionaire Carlos Slim, the owner of the dominant Mexican wireline and wireless providers, Tracfone doesn’t actually operate a network in the United States. Instead, it operates as a Mobile Virtual Network Operator, or MVNO, reselling service on both CDMA and GSM networks.

I was interested to learn more about this service, so I purchased a starter kit for about $70 at Wal-Mart. It came with a Samsung T301G handset, 1 year of service, 200 airtime minutes, both wall and car chargers, and a carrying case. The SIM card was pre-installed in the handset, and was designated to AT&T (a “P4” type SIM). Depending upon the market, you may receive a “P5” SIM card, which is designated to T-Mobile.

You can set up the handset either online or over the phone. I set it up online, which was easy and straightforward. To start the process, Tracfone asked for the IMEI of the handset. Next, the site asked for personal information (which isn’t validated—you can enter anything) including a home phone number, and asked if I wanted to opt in for telemarketing and SMS ads (I declined). You can then either port in an existing cellular number or have a new one issued. I chose to have a new number issued. Tracfone requested the ZIP code where I planned to use my phone the most. I entered a Seattle ZIP code and was provided a Seattle number, issued by AT&T Mobility. At that, I was instructed to power cycle the handset. It was automatically programmed over the air and loaded with 210 minutes, with an expiration date 425 days in the future. This was better than the 365 days and 200 minutes promised on the package.

Tracfone has spent a considerable amount of effort to prevent their handsets from being unlocked. This is primarily because of the heavily subsidized nature of their handsets; phones are sold well below cost and the revenue is made up through airtime sales. SIM cards are specialized. They only work on Tracfone-branded handsets loaded with Tracfone “airtime tank” firmware. Once you insert a SIM card for the first time into a Tracfone, it’s forever married to that phone and cannot be used on any other phone. Non-Tracfone SIM cards cannot be used on Tracfone handsets, either.

The firmware of the handset is also locked down, most interestingly in the dial plan. International calls can’t be direct dialed from the handset, even to Canada. Some domestic calls are also blocked even though “Nationwide Long Distance” is promised. Calls to the Commonwealth of the Northern Mariana Islands and Guam are blocked, although calls are permitted to Puerto Rico and the US Virgin Islands. Tracfone does not appear to block calls to high access charge areas, and I was able to complete a call to a chat line in Garrison, Utah (hosted by the independent LEC Beehive Telephone Company). AT&T is the underlying long distance carrier for domestic calls.

To some degree, I was surprised at the friendliness of Tracfone billing. Unlike AT&T Mobility, Tracfone does not bill for ring time beyond the first 30 seconds. Only calls that supervise are charged, and forward audio is even sent on calls that do not supervise. On the other hand, Tracfone bills for calls to customer service, which is unusual for a wireless provider.

While a basic WAP browser is included, you can only visit a pre-approved list of sites linked from the Tracfone portal. Attempting to browse other sites yields a “403 Forbidden” error message. It is possible to download ringtones and some basic applications sold on the Tracfone portal (although some users have worked around this limitation by sending .JAR files to themselves as Gmail attachments). Not surprisingly, Bluetooth is also locked down; only headset profiles are allowed. SMS is allowed (billing 0.3 minutes per message sent or received), but is limited in the dial plan to domestic SMS only.

With all of the efforts made in locking down the handsets and SIM cards, I was curious how much effort Tracfone made to lock down the network. As it turns out, there are a couple of glaring flaws: voicemail and international calling. Voicemail deposits are free with Tracfone, and the AT&T Mobility voicemail platform is used. This service uses a “backdoor number,” to which your handset connects when you check your voicemail. The “backdoor number” is shown briefly on your handset when you hold down the “1” key. Tracfone attempts to conceal this number in the firmware by quickly wiping the display, but by watching carefully and dialing a few times, you’ll be able to capture the number. Calling directly into this number from another phone (such as a land line) prompts you to enter your mobile phone number. You can do this, press * during the announcement, enter your password, and check your voicemail for free. International calling is also free with Tracfone, provided you use a toll-free gateway operated by Auris Technology, a VoIP provider. Calls are of acceptable quality. Most interestingly, the Auris gateway uses only the ANI of your Tracfone for validation, and billing is apparently not synchronized with the AT&T or Tracfone billing platforms. By spoofing the ANI of any Tracfone when dialing this gateway, you can make virtually unlimited long distance calls to over 60 countries.

And… pardon me for a moment. I’m nearly bent in half from coughing fits, and I’m now four hours and one minute into my shift. It’s time for me to go home, and to bring this column to a close. Have a safe and phun spring, and stay healthy!

References 

http://www.tracfone.com – Tracfone official site.

http://www.net10.com – Net10, a Tracfone brand with more expensive phones and cheaper airtime.

http://www.safelinkwireless.com – Safelink Wireless, a Tracfone product targeted toward recipients of public assistance.

http://www.straighttalk.com – Straight Talk Wireless, a Tracfone brand sold exclusively through Wal-Mart and operating on Verizon’s CDMA platform.

http://thejmart.com/difzip.htm – Tracfone tips, tricks and codes.

Other Tracfone Brands

This column focuses on the Tracfone-branded service. For your reference, Tracfone service is marketed under four different brands:

  • Tracfone: The most popular service. Available in all 50 states, offers both GSM and CDMA service depending upon the area in which subscribed. I tested GSM service on the AT&T network. Although monthly plans are available, service is primarily sold by the minute with varying rates depending upon whether the phone subscribed offers “double minutes for life” (DMFL) and the number of minutes purchased at once. Airtime for most cards expires in 90 days, with a 1 year $100 card available. Your minutes roll over if you recharge before they expire.  In general, handsets are heavily subsidized (selling for as little as $10) but minutes are more expensive. International calling is blocked, but dial-around service is available to 60 countries at no additional cost.
  • Net10: Similar to the Tracfone product, using the same billing platform, but all minutes cost 10 cents. Handsets are more expensive and airtime expires sooner. Additionally, international calls cost an extra 5 cents per minute.
  • Safelink Wireless: Operates on the Tracfone billing platform. This service provides a free phone and 55 monthly cellular minutes free for customers who qualify for a federal LifeLine subsidy (generally welfare recipients). Available in 21 states and the District of Columbia.
  • Straight Talk: Marketed exclusively through Wal-Mart, this service is sold with one of two monthly plans costing either $30 (1000 minutes+1000 text+30MB data) or $45 (unlimited text/talk/data). This service includes only Verizon network coverage, with no roaming allowed.