Chapter

7

Telephone Secrets You Need to Know

In This Chapter

The telephone is a tool. I know, all this time, you thought it was a voice instrument used primarily for ordering pizza. Surprise, surprise, it’s really the most basic tool in the private investigator’s toolbox. A competent PI can find out more information using the phone than any database can possibly provide. You may not always have access to your computer, but you should be able to lay your hands on your smartphone.

This chapter examines the ins and outs of using the telephone to enhance your PI career. To make the best use of the phone, sometimes you have to outwit the person you’re calling, and frequently you have to outsmart the telephone company itself.

Verifying Nonpublished Numbers

In the private investigation business, sometimes knowing where your subject lives is just as good as knowing his telephone number. If you want to conduct surveillance on an individual, you don’t necessarily need the telephone number, but you do need the address so you can get out of bed well before dawn, venture out into the cold while every sane person is still sleeping (isn’t PI work fun?), and set up the surveillance on the residence before the subject leaves for work.

You’ve already run the subject’s name in one of your databases and found an address for him, but you’re not sure whether the address is current. The databases are not infallible, and they may have out-of-date information.

Next, you check directory information, where you can get a phone number as well as an address. If you call 411, the recording and the live operator might both report the listing as nonpublished. What do you do? You certainly don’t want to get out of bed and go to the wrong address. You could run all of the other checks I tell you about in Chapter 5, but there’s an easier way to verify the address when your subject has a nonpublished number.

DEFINITION

With a possible address in mind, and knowing that the subject’s telephone number is nonpublished, mumble your way through the 411 computer until you get the live operator. Next, tell the operator you’d like her to check a listing for you. Tell her that you think the number is nonpublished but that you’d like to verify the address.

Operators don’t get this request very often because most people don’t know that you can verify an address on nonpublished numbers. Be prepared to have her say she can’t give you the address. When she says that, tell her that’s okay; you already have the address, you just want to verify it. Give her the address where you think the subject is living. Either she’ll confirm it or she’ll tell you it’s a different address. She might not be willing to give the address to you, but she does have it in front of her on the screen, and there’s a good chance that she will verify it for you if you give it to her first. If you’ve got the right address, set the alarm for about 4 A.M. and go to bed early. Although this doesn’t work for all telephone companies, I’ve found that it does the trick 99 percent of the time.

THE SCOOP

Breaking the Number

Obtaining a telephone break can be one of the most challenging and exasperating problems facing a private investigator. A wife may come to you with a telephone number she found in her husband’s billfold or coat pocket. The wife suspects the number belongs to her husband’s mistress, and she wants to know for sure.

DEFINITION

In obtaining a telephone break, you have to first satisfy yourself that the client means no harm to the subscriber. The last thing you want is to find that, by breaking the phone number, you’ve enabled your client to go to the subject’s address and attempt to physically harm that person.

Next, arrange the price with your client. On a listed number, the price should be about $30. It’s hardly worth the paperwork if you charge any less. For a nonpublished number or a cell number, charge about $150.

Start with the easy checks. If you subscribe to Skipsmasher.com, go there; otherwise, go to www.masterfiles.com or www.555-1212.com and run a reverse search on the number. There’s a good chance that the number will be a regular listed number, and you will have just turned a 25¢ search into an extra $30 in your pocket.

If those searches come back as “no record,” it’s more than likely either a nonpublished number or a cell number. But some other possibilities exist. For example, if the client picked the number off her caller ID instead of finding it in her husband’s billfold, it could be a trunk-line number, such as a T1 line, from a commercial establishment. You can do a simple, free search to find out what kind of line it is: go to www.phonevalidator.com and enter the number to find out whether you’re dealing with a cell number or a landline.

If you find out that it’s a cell number, see the section later in this chapter on cell phones.

If you find out your number is a nonpublished landline, you may want to use one of your favorite telephone information brokers to break the number for you. You can expect to pay around $50 for the service. But if you’re not a licensed PI, most of these data brokers won’t deal with you.

LEGAL TRAP

Another option is to use one of my favorite techniques, a pretext call, which works most of the time. Actually, in my 20 years in the business, I don’t recall it ever having failed. In Chapter 12, I talk at length about the do’s and don’ts of pretext telephone calls. You need to read that section before attempting this particular pretext call.

LEGAL TRAP

The pretext goes like this. You spoof your caller ID so it will show the name of the pizza company you claim to be from. Be specific—use the name of a pizzeria in your local area. Call the number. Identify yourself as a representative of that pizza home delivery company. Tell him that if he answers three quick questions, you’ll send him a coupon for a free large pizza.

Here are the questions:

• Have you ordered home-delivery pizza from (insert the name of the company) within the last three months?

• If so, how many times per month do you call for home delivery? If never, do you know where the closest home-delivery outlet is?

• Are you familiar with Sicilian-style pizza, and have you ever ordered that?

Now, you don’t give a hoot about the answers to the preceding questions, so just get through them as quickly as you can. Next, thank him very much for his time. Tell him you’ll send him a coupon for a free large pizza, and thank him again for his participation in this survey. To what address should you send the coupon? If he’s gone this far with you, he’ll always give you his address. And what name should you address it to? Bingo, you’ve got his name and address. If he wants it to go to a P.O. box, take the box information (it might come in handy later), but tell him that these coupons can’t be mailed and the delivery folks will drop one off, so you need the street address and apartment number, if any.

Finding Other Sources for Nonpublished Numbers

Just because a telephone number is nonpublished doesn’t mean you can’t get it. Nonpublished simply means the telephone company won’t give it to you willingly. Fair enough.

What I find, however, is that although the subscribers have made that request to the telephone company, they violate their own instructions by giving it to the cable company, the electric company, the water company, the pizza delivery company, the newspaper for home delivery, service and repair companies of all kinds, the credit bureaus, their employer, the schools their children attend—the list of folks who have the nonpublished number goes on and on and on.

In many locales, the utilities are publicly owned, and so are their records. All you have to do is go to the source, examine the records, and find the nonpublished number.

If the utility records where you live aren’t public, look at your list of friends and see if any of them or their spouses work at the cable company, the newspaper, or any other place where your subject may have given out his number. If you think of someone, ask that person to get the number for you. But you don’t want to ask this favor of anybody you know who works for the telephone company. First, it is a violation of the telephone company rules for employees to divulge proprietary information. Second, it could be considered theft of information. The likelihood of either you or your friend being prosecuted for it are nil, but still, your friend could lose her job.

If you can’t find a friend who can get the nonpublished number for you, go to your favorite broker of telephone information and pay to get it.

Tracking Down the Location of Pay Phones

My client’s 16-year-old son ran away. Anybody who has dealt with a teenager would think my client should be ecstatic. The kid’s finally out the door. But no, the client wanted him back. And the kid didn’t even take the family car with him. Go figure. This particular runaway is someone I’ve picked up and returned to his family four times in four years, so I knew the kid’s friends and haunts pretty well.

This time, the boy apparently headed south to a city 200 miles away. The girlfriend cooperated with us to some degree because she was more mature than the boy and was genuinely concerned for his safety, although she wouldn’t rat out the kid entirely. She never told us exactly where we could find him. She did say he would routinely call her from pay phones, and she would call him back because he didn’t have any money.

We got the incoming phone numbers from the girlfriend’s cell phone bill. I then ran a reverse search on the numbers. After running the reverse search, it was pretty easy to figure out which numbers were pay phones and which weren’t. That’s because pay phones frequently have repeating numbers or a successive series of numbers in their phone number, such as 305-768-9999 or 305-768-3456. (However, that’s not always the case, so don’t count on it.) Next, we needed the physical address for the phones because we wanted to stake them out to find the boy. (For more details on finding runaway kids, check out Chapter 15.)

Sometimes taking the direct and honest approach works just as well as being sneaky. Although the locations and phone numbers to pay phones are not published in the telephone directories, they’re not a secret. In this case, I called the telephone company business office and told them I was a private investigator. I explained the facts of the case, and in a few minutes, after the customer service representative checked with her supervisor, she gave me the street address where the phones were located.

I plotted the street locations on a city map. They all fell within about a three-block radius in West Palm Beach, Florida. You have to read Chapter 15 to see if we found the runaway boy, but now you know how to find the location of a pay phone if you have the number.

Cell phones are rapidly putting pay phones out of business. And smartphones are slowly but surely replacing traditional cell phones. PIs can mine cell phones and smartphones for a great deal of information. You just need to know what you’re looking for and how to get it. To find out how, keep reading.

Giving Caller ID the Runaround

Part of being a clever and successful PI includes knowing how to keep your subject from seeing that your call originates from a private investigative office. It’s a growing challenge, since caller ID comes standard on almost all cell phones, and many, many residential telephones are equipped with it as well. An astute investigator has to assume that every telephone number he dials is going to show the recipient the calling telephone number and probably the name. It’s a fact of life that the private investigator has to deal with and be prepared to circumvent when necessary.

In the following sections, I show you some ways to circumvent caller ID.

Dial *67 Before Dialing the Phone Number

Most landline telephone companies allow a person to dial *67 before dialing the phone number. Dialing *67 blocks the transmission of the caller ID information to most telephone numbers. A *67 blocked call is reported to the receiving party’s caller ID as a “private call.” Usually no additional charge is levied for this service if it’s available within your area.

Another service phone companies provide is automatic number identification (ANI). (Some telephone companies call it automatic identification number [AIN] instead of ANI.) ANI is typically used with toll-free numbers, 911 emergency operations, and large companies, but anybody willing to foot the expense can have the service. ANI sends different data over different lines than caller ID, and you can’t block it by dialing *67 first. However, with spoofing technology, you can spoof a toll-free number if the spoofing service allows it. Technically, it can be done.

If you call any subscriber to the ANI service, he or she will be able to see your number. Not all ANI subscribers have “real-time ANI,” which gives the recipient the caller’s phone number at the time of the call; 911 relies on real-time ANI to locate callers. Toll-free subscribers usually get their list of callers at the end of the month, along with their bill. However, if they have caller ID service on their lines, your phone number will appear on their caller ID screen at the time you make the call. ANI service is usually combined with more sophisticated telephone equipment and lines such as a T1. Expect to pay more than $1,000 a month to get it started.

You can dial *67 from your cell phone, too. Before entering the phone number you want to call on your cell, enter *67. Your number will show up on caller ID as a private or restricted number. Note that *67 doesn’t work for toll-free numbers or anyone subscribing to ANI; they will see your real number on the caller ID screen. You’ll end up as naked as the emperor in his new clothes.

When someone phones my agency using a toll-free number and refuses to identify himself, or if my staff or I need to know who a particular caller is, we write down the date and time of the call. When the toll-free bill comes, we compare it to our list of suspect calls by date and time, and we usually can identify the caller. If the unknown call is particularly important, we can wait one day before calling our toll-free provider, who can then provide us with the phone number for the call.

Use a Spoofing Service

Spoofing a caller ID is a technique in which numbers are substituted in the caller ID data stream so that the “real” originating number is not shown, but “fake” numbers appear, or seem to appear, on the caller ID screen. You can find several companies that offer spoof searches online simply by typing “caller ID spoofing” into your favorite search engine. Your search should turn up several vendors. If you plan on doing a lot of spoofing, you might want to look at Rapidvox.com, which works with a lot of PIs.

Note that you cannot dial 911 through these companies’ spoofing systems. They may also block some toll-free numbers, and they can block whatever numbers they feel are appropriate. They also won’t tolerate “misuse of their system.” The spoofing works in North America and Canada, but it probably won’t work in Hawaii because of the long-distance rates or any place where you have to dial a country code first.

LEGAL TRAP

The Fair Debt Collection Practices Act prohibits “the use of any false representation or deceptive means to collect or attempt to collect any debt,” which means that debt collection personnel cannot spoof their telephone numbers. Other than that, I know of no law that requires the calling party to provide to the receiving party the calling party’s phone number.

In addition to spoofing services, many spoofing companies offer services that change your voice from male to female and vice versa, and also record the call. In some states, implementing the recording feature could be illegal, but in “one party” states it may be legal (see Chapter 16 for details).

An attorney recently hired me to track down a passenger in a vehicle accident. I called the young man’s family, and they said he no longer lived there, but they would pass along my message. No return phone call. A few days later, I called the family again. Once more, they said they’d pass along my request to the witness. No return phone call. I called the family again, and this time got the father, who, when I asked, gave me the young man’s cell phone number. The lesson there is, if you don’t ask, you won’t receive.

I called the cell phone and left a message. No return phone call. I called the cell phone again and left a message. Yep, you guessed it, no return phone call. Okay, maybe I’m a little slow, but I finally figured out the kid didn’t want to talk to me.

I called the number one more time, but this time I spoofed my caller ID. I could have blocked it by dialing *67 first, but it would show up on his cell phone as either restricted or private. I didn’t want that, so I spoofed it. Now, think for a moment. What number did I want to insert as a substitute that would show up on his cell phone instead of my real number? I wanted a number that he would see and be sure to answer.

I had his family’s home number. Right. I spoofed my number to look like the old homestead was calling him. Mom was calling to invite him over; the meatloaf would be ready soon. And guess what? He answered the phone, and I had him. In my mind’s eye, I could see him sitting there scratching his head wondering why his cell phone had said it was his mom calling, but instead it was me. But he never thought to ask. I set up an appointment to meet him the next day and took a recorded statement from him. It wouldn’t have happened if I hadn’t been able to spoof my caller ID.

LEGAL TRAP

The Myth of the Untraceable Prepaid Cell Phone

You can walk into almost any stop-and-shop market or a discount store like Wal-Mart and, for less than $30, buy a prepaid cell phone with 10 minutes of airtime on it. You can buy time to add to your cell phone at the same store for less than 20 cents per minute. Using the “throw-away” cell phone is a favorite ploy of mystery writers. The kidnappers use them for ransom demands because they’re “untraceable.” Right? Well, yes, no, maybe, maybe not.

To understand whether these phones are untraceable, you have to define what you mean by untraceable. Let’s take a closer look.

You can purchase these with cash and don’t have to reveal any personal identifying data. So in a sense, you can make anonymous calls on them, and only the cell phone number assigned to your phone will show on the receiving party’s caller ID.

If you make some illegal or threatening call, can law enforcement trace that call back to you? Think like an investigator. First, assume that whomever you called will have the phone number of the prepaid phone. That’s a given. And even if they don’t have caller ID, law enforcement (LE) can get the numbers that called that person’s phone, and your cell phone number will be there.

Now, how is law enforcement going to trace the phone back to you? These phones are sold by various companies in numerous stores. But each phone has an electronic serial number (ESN) programmed into it. The prepaid cell phone company certainly keeps track of which phones went to which retailer. So it’s not too difficult to see how, once law enforcement has your particular cell phone identified, they can trace it to the retail outlet that sold the phone. The phones require activation at the time of sale, so the exact time of the sale is recorded.

DEFINITION

When you’re buying a prepaid cell phone, look around. Do you see yourself on a video monitor somewhere? Bingo. Now they not only have your phone identified, but they also have a photograph of you buying the phone. And if they have your photograph, how far away do you think you are from being identified?

Also, since they know your ESN, every time you switch that phone from off to on, it is possible that law enforcement will know which cell tower you’re close to. If the phone is GPS equipped, you can be located within a few yards—or, at least, to the nearest cell tower.

Not to give away all of law enforcement’s secrets, but if the stakes are high, they’ll have a list of all the phone numbers you called using that cell phone. If you called your mom, she’ll identify you from the photo they show her.

So are those prepaid cell phones untraceable? Well, you decide. However, if you want to use one just to side-step caller ID rather than engage in illegal activities, I think they’re a pretty good product for that.

Mining Cell Phones and Smartphones for Data

Landlines are slowly but surely losing ground to cell phones and Voice Over Internet Protocol (VOIP). As a PI, you may find yourself dealing with cell phone communications in a number of ways.

DEFINITION

Breaking the Cell Number

You can use a couple neat tricks to break a cell number. Instead of calling the number, go to Skipsmasher.com and use the Voice Mail Probe; if you don’t have a PI license, try Spydialer.com, which is free. With either of these features, you enter the cell number in question, and a computer calls the number. The computer call bypasses the cell phone’s ringer and goes right to voice mail. Within a minute or less, you will be able to hear the voicemail message belonging to that phone.

HIDDEN HINT

Another option is to use masterfiles.com. This company offers reverse cell number searches and charges you (about $5) only if it gets a hit. Finally, you might try Patrick Baird, at pdjservices.com; if he’s convinced you have a real need for the information, he can help you. Patrick has always treated me fairly and is reasonably priced.

The next easiest way for a PI to get a break on a cell phone number is to pay the information broker. It’s quicker for me to send the number to my phone guy and get a response from him the next day with the information I need. The client is footing the bill anyway.

If you’re not a PI and you don’t have a “phone guy,” you can call the number and pretext it. You can use the same pizza pretext that I recommend for the nonpublished number earlier in this chapter, with a few changes in the questions. Start like this: “We know we’ve called you on your cell phone, but this will take less than 60 seconds, and we’ll send you a coupon for a free large pizza from (name the pizza company) if you answer two questions for us:

• Have you ever used your cell phone to order a pizza from us?

• Have you ever used your cell phone to order any other type of carryout food so that it would be ready when you got there? If so, what type and how often?

Then say, “Thank you very much for your time. To what address should we send you the coupon for the free pizza? And what name should we address it to?”

I’ve had pretty good success with this pretext for cell phones. It’s not unusual for the person answering to say he doesn’t have time to talk right then. If he says that, ask if it’s okay to call later. There’s no gimmick, and you’re not trying to sell anything, so most people are willing to cooperate.

Three FAQs about Cell Phones

If you work in the investigative business for long, you’ll find that clients frequently ask three questions about cell phones. I answer each of these pressing questions in this section.

Who does the cell phone belong to?

First thing to do is check PhoneValidator.com to make sure the number is a cell number. Next, try SpyDialer.com and listen to the voicemail message, if there is one. If that doesn’t reveal the owner, try using your favorite search engine and just putting in the phone number as the search parameter. I haven’t had much luck with that, but some people swear it works. Try the pay databases or the pretext I outline in the preceding section, or use a phone data researcher like PDJServices.com, who will dig it up for you for $50.

Where is the cell phone located?

You can track a cell phone so that you know where it—and, hence, the user—is. (Some underhanded companies will try to sell you cell phone pings. They charge about $400. Don’t fall for them.) Smartphones have useful apps, such as iPhone’s Find My iPhone app. I’ve had dozens of clients install that app on their spouse’s phones so that we could follow them easily. The app won’t tell you who they’re with and what they’re doing, or take photos of what they’re doing (which is why PIs are still needed), but it will tell you the phone’s location. Smartphones also cache their GPS locations, and you can view or download this cache of information.

LEGAL TRAP

Can I install spyware on my spouse’s phone?

Some companies sell technology that you can install on a cell phone. It allows the installer to dial a silent call to the cell phone, which activates the phone’s microphone and turns the handset microphone into a room microphone. This is patently illegal and violates federal and state eavesdropping and interception of communication laws. (However, the U.S. government uses this technique and does not require direct physical access to the phone. It performs a system update, and the software is installed. So if you’re planning something illegal, turn off your phone.)

THE SCOOP

Examining Cell Phones for Other Data

Cell forensics is the process of recovering deleted text messages, images, audio recordings, and more from cell phones. It can also involve obtaining call detail records, which are generally obtained through the carrier; these contain call records and tower data. Tower data can be extremely useful in placing a cell user within or away from certain proximity of a cell tower.

Cell forensics has become widely known in the private sector, having established itself as a hot commodity for prosecution and defense alike. For obvious reasons, criminal defense attorneys either love or hate cell forensics. Either way, to get good data that will stand up in court, you need to find a skilled expert to examine the phone and associated records. It takes a trained eye, acquired skill, and patience to perform a competent exam of a cell phone. The “sticks” many PIs use will help perform a cursory exam but are not qualified for forensic examination use.

I went to Mitch Davis of tcmusa.com for a few tips about cell forensics; I share that information with you here.

Today’s cell phones are divided into two categories: standard and smart. Popular smartphones include Blackberry, iPhone, Android, Symbian, and Windows mobile. Popular standard phones include the Casio Rock, Samsung A460, and Motorola Razr.

The type of information that’s recoverable depends on the device’s capabilities, the carrier (Sprint, T-Mobile, AT&T, and so on), and the technology used by the carrier. The device and/or technology used for cell forensics plays an important part in what you can recover.

HIDDEN HINT

What can be recovered from a cell phone depends on the type of acquisition performed on the phone:

• A logical examination provides information that is readily available on the phone, such as text/MMS messages, photos, call history, phonebook, sometimes voicemail, and other simple information.

• A physical acquisition recovers all the information provided by a logical examination plus flash memory data, raw coding, full and partial deleted text, the last location the phone was at outside its normal roaming area, and more. Often enough useful data can be discovered within raw text files inside a device.

SIM cards can contain text messages, phonebook info, subscriber info, security information, and carrier data. SIM cards in iPhones do not contain user-friendly data. Useful data from an iPhone can be found inside of the backup file located on the user’s computer, if they have backed up their phone to iTunes. We have recovered data from iPhones that were never backed up or updated. The phone data stored on the actual device went back to the day the phone was placed into service.

HIDDEN HINT

Performing cell or handheld forensics requires many hours of formal training and is always subject to scrutiny when used in court. Considering that a new phone is introduced into the market every three to six days, it can be challenging to keep up with new devices. A PI taking a phone-in request from a client must get a signed authorization to perform the exam, as well as understand what to do and what not to do with a handheld device that is to be examined. Cell forensics is a valuable tool for civil and criminal cases, but you need to handle it with care!

The Least You Need to Know

• Directory assistance operators will verify a nonpublished address if you give them the address, but they will not give you the address outright.

• Phone numbers and cell numbers can be broken by use of pretext phone calls.

• Nonpublished numbers can be found in public record information and retrieved from sources other than the telephone company.

• Bypass caller ID by dialing *67 before the number, using a pay telephone, or using a prepaid calling card.

• Caller ID spoofing can be an effective tool if used for legitimate purposes. It might be illegal to use it to defraud or with intent to cause harm.

• Cell phone forensics can reveal text messages, voicemail, photos, and deleted texts.