You Are Here: Home » Electronics Projects » Wireless Transmitters, Bugs & Taps » Phone Tapping – How to Tap A Phone

Phone Tapping – How to Tap A Phone

When you hear Phone Tapping, the only questions that rises in your head is that How to Tap A Phone. These Phone Tapping devices have aroused curiosity in so many people.

WARNING: Connection of unauthorised equipment to a public (or indeed private system is illegal and could lead to prosecution.


Now with the warnings over here is the equipment. Because of the highly sophisticated nature of the modern telephone network, the installation of the tap is a very tricky business indeed. It will take a capacitor (100nf), a pair of high impedance headphones, anything up to two crocodile clips and at least twelve seconds of concentrated effort. (See fig. 1)

FIG 1:


One alternative to hanging around waiting for the telephone to answer is to connect up a tape recorder. Now we come to the really sophisticated electronics: since it is waste of tape to run the recorder continuosly, it is useful to switch it on only when the phone is being used. Voice activated switches? Why bother. A relay will do the trick, connected in series with one of the lines. See plans on how to build a TAN box. There are plenty around.


The next step up in Phone Tapping – How to Tap A Phone is some kind of radio bug. In the days not so long ago when the BT issue phone was a wedge of cheese shaped affair with a dial on the front, a favourite bugging device used to be the ‘drop in’ mike. The handset microphone was a carbon granule device, quite bulky but easy to remove; unscrew the mouthpiece, slip off a pair of wires from their terminals and its out. The crafty buggers found a much better use for all that space than filling it with carbon granuals. Buying microphones from the very same people who supplied BT, they would empty out of the granuals, put in a much smaller mike and would empty out the granuals, put in a much smaller mike and a small radio transmitter, then seal the whole thing back together again. Drop it into the handset and off you go. It is estimated that the numbers made around the world ran into millions, so they were not uncommon! Still used for bugging public telephones, but not much good for the wide varity of office and home phones now in use.


Also very common and readily available are a variety of bugs which connect either in series with one telephone wire or in parallel across the two. The series bug has the advantage of only transmitting when the telephone is used; the parallel one transmits continuosly in its crudest form (and most commercial bugs are pretty crude) but can be a little more difficult to detect by simple voltage measurements. Let’s face it, it would be a trivial matter to design a bug that is both triggered by use of the phone and virtually impossible to detect by voltage measurements, but since almost nobody takes seriously the idea that they may be a suitable target (do you think you are, for instance?) and therefore won’t be checking, why bother with anything complicated?

See picture 1 and 2 for details. (End of file)


The most exotic of the commonly used listening devices is the ‘infinity transmitter’, so called because once the victim can be snooped on from anywhere in the world. Anywhere his phone can be reached by direct dialling, that is. This is what you do: dial up the victim’s number and hold your little black mystery box close to the mouthpiece. In the simplest versions, the mystery box just sends a tone down the line which is picked up by a frequency selective circuit inside the bug. The mystery box activates the infinity transmitter, which you previously attached to the victim’s phone. Once activated, the transmitter prevents the phone from ringing, and instead sends down the line any sounds picked up by the victim’s telephone, or by the bug’s own internal microphone.

This is how it works. On recieving the activating tone, the transmitter passes enough current between the two lines to fool BT’s equipment into thinking that the phone has been answered, so the ringing tone is cancelled and the line is opened. Once connection is made, all the bug has to do is to modulate the line voltage in just the way the telephone itself would. Not very difficult. The victim is entirly unaware of anything happening and, with a hookswitch defeat installed, it could be his own telephone acting as a microphone for the transmitter. The bug will automatically cut out if the handset of the victim’s phone is lifted, allowing it to be used normally.

See picture 2 for details. (End of file)


Much simpler than the infinity transmitter, and used in much the same way, is the hookswitch defeat. When you hang up the telephone, a switch disconnects the handset… unless, that is, somebody has doctored the phone. The simplest method is just to wire a resistor across the switch. In use you phone the victim, apologise for having called up the wrong number, let him hang up but keep your phone off the hook to hold open the connection. Then you listen in. The sound level won’t be very high, so you may need an amplifier.

The difficulty with a plain hookswitch is that you need access to the telephone itself and enough time to dismantle it. There is also the possibility that an innocent caller may be slow to hang up and find himself accidently eavesdroping. A bit of a giveaway. Hookswitch defeats are easy to spot by anyone familiar with the insides of a telephone, but can often be overlooked in inspection by a suspicious buggee since, unlike infinity transmitters and the like, it could easily be part of the workings of the phone.

Take the idea of ‘looking as if it belongs’ to its conclusion and you have the ‘lost’ tranmitter. What you do is to find a large-ish component in the telephone (or typewritter, calculator, or whatever) which itself uses any signal you need access to. You then rush home to your garden shed and knock up a device which not only does what this component does, but contains a transmitter too. You package it to look exactly like the component you’re replacing. Then you pop back one night and swap the two around. Anyone inspecting the phone or whatever will find it contains exactly the components it should – no more and no less. The transmitter is really and truly lost.

This really is big league stuff – the kind of trick employees of rival governments like to play on each other. Not the kind of thing you will personally come across unless you have access to very valuable information indeed. There’s an American company called Fox which could be persuaded to come up with the goodies if you approach them in the right way and have the funds. They’re in the phone book.

Okay that is about it for Phone Tapping – How to Tap A Phone, but do bear in mind that BT are very touchy about having alien equipment connected to their lines, even if it is just a capacitor and headphones.

Circuit diagrams:

Circuit 1:

Series phone bug:


% = capacitor
$ = resistor
(+) = transistor
& = tuning coil
&) = inducer
W = aerial

Parts needed:

R1 = 270k
R2 = 10k
R3 = 10k
R4 = 1k0

C1 = 15pf
C2 = 1nf0
C3 = 1nf0
C4 = 5pf0

Q1 = ztx300

L1 = inducer 33uh

BR1= bridge rectifier

Tc = tuning coil 3mm (4 or 5 turns)

Circuit 2:

Parallel phone bug:


% = capacitor
$ = resistor
(+) = transistor
& = tuning coil
&) = inducer
)&( = audio transformer
| = battery
@ = neon
W = aerial

Note: a * indicates a join or a corner and a + indicates a wire cross over.

Parts needed:

R1 = 10k
R2 = 220k
R3 = 12k
R4 = 220r

C1 = 10nf
C2 = 47pf
C3 = 1nf5
C4 = 25pf
C5 = 1nf5
C6 = 10pf

Q1 = ztx500
Q2 = ztx300

N1 = neon

A1 = audio transformer 25k )&( 1k0

B1 = 9v battb

L1 = inducer 1.8uh

Tc = tuning coil 3mm (4 or 5 turns)

Circuit 3:

Infinity transmitter:


% = capacitor
$ = resistor
(+) = transistor
&) = inducer
)&( = audio transformer
() = microphone
>> = diode
<< = diode (polarity reversed)
<_< = zener diode

Note: a * indicates a join or corner and a + indicates a wire cross over.

Parts needed:

R2 = 33k
R3 = 33k
R4 = 4k7r
R5 = 4k7
R6 = 1m0
R7 = 100k
R8 = 68k
R9 = 82k
R10= 270k
R11= 68k
R12= 1k0
R13= 10k
R14= 390k
R15= 390k
R16= 10k
R17= 56r
R18= 15k

C1 = 4nf7 unpolarised
C2 = 10nf unpolarised
C3 = 10nf unpolarised
C4 = 10uf polarised +’ve to top
C5 = 10nf unpolarised
C6 = choose to tune
C7 = 4uf7 polarised +’ve to top
C8 = 4uf7 polarised +’ve to right
C9 = 1nf0 unpolarised
C10= 1nf0 unpolarised
C11= 2uf2 polarised +’ve to top
C12= 47uf polarised +’ve to top
C13= 1uf0 polarised +’ve to top

Q1-q9 = bc108

A1 = audio transformer 500r )&( 10k

D1 = 1n4148
D2 = 1n4148

Zd1= 6v8 zener diode

L1 = inducer 40mh

Leave a Comment

Scroll to top