I had a lot of fun hacking WATS service in the 1970s. (And, it was legal!)
WATS service was a flat rate service offered by the Bell System mostly from about the 1960s through the 1980s. You paid a flat rate and could use the line as much as you wished.
The Bell System offered this service as a way to provide discounts for larger customers who often would have alternative ways of communicating that cost less than DDD (Direct Distance Dialing). There were several benefits to the Bell System.: They didn’t need to itemize the calls placed (billing was done simply by reading a timer/meter on each line that clicked every 1/10minute.) Also, customers would tend to pack their WATS lines by time-shifting peak calling to non-peak hours, and this load leveled the long distance network.
WATS lines were sometimes not wired in the same way as POTS lines, and this made them have magical powers.
Because It was impossible to abuse a WATS line because it was flat rated (or meter rated.) It didn’t matter who the customer called because billing was just based upon minutes the line was off hook.
Various arrangements were use, but one of them (in St. Louis) was that a WATS line would come directly out of a Class 4 toll office. There was a special appliqué that was applied to the line that would collect digits and then send them in MF form to the office. (At the time, Class 4 offices mostly only understood MF or SF signaling.) The appliqué would collect 10 digits and then dump them as MF into the Class 4.
There were magic phone numbers that only switchboard operators were able to dial. These were usually of the 1×1 variety, such as 141. By dialing 206-141 an operator somewhere in the US could reach a Seattle inbound operator. There were times that you just NEEDED an operator’s help in a far distant city, such as if your community didn’t yet have direct distance dialing.
So here is how the hack worked: From a WATS line you could dial an area code and one of the internal-use-only codes and then digit pad the number to 10 digits. By dialing 206-141-1111 you would reach the inbound operator in Seattle.
Better still, the inbound operator would know you were an official Bell System operator because inbound lines could ONLY be dialed by other switchboard operators. So when you dialed 206-141-1111 the operator in Seattle would answer “Seattle Inbound” and if you sufficiently spoke telephonese she would do anything you wanted.
Say “Place Name 206 223” And she would tell you the city and exchange name of that central office. Say “Verify 206 <Phone Number>” And she would click into that line and listen for voice. This would kill any modem connection, so if you needed into a busy bulletin board you could ask the operator to verify the line, which would kill the connection and then free it up for you. Say “Test Desk 206 223” and you would get transferred to the test desk for that exchange. Now, the Test desk would perform any type of maintenance for you. One of the more abusive possibilities was that you could reach the international operator who would place calls for you…assuming that you the operator was doing the actual timing and billing for the call.