Telephone security checklist.

In this high-technology world, the ubiquitous telephone has become a powerful weapon in the hands of thieves. It can be used as a "key" to unlock a wide assortment of confidential data. The steps in this checklist are adapted from the American Institute of CPAS information technology membership section's Technology Alert, "Avoiding Telephone Fraud." It was developed by Rosemary Zirille, voice communications coordinator at Crowe Chizek & Co., South Bend, Indiana.

General Security

* When a new office telephone directory is prepared, don't just throw the old one into the garbage. Shred it. The same goes for fax sheets and identification codes for voice mail and electronic mail. Some thieves, known in the trade as "dumpster divers," go through garbage dumpsters looking for such propietary data.

* If an employee's wallet is lost or stolen, instruct the victim to report all the missing cards - not just credit cards. Telephone calling cards are becoming favored theft targets. High-tech thieves have ways to figure out the secret personal-information code.

* Beware of incoming callers who ask for an extension without a name. Such callers could be thieves who want to get into the office telephone network; once an extension is given to them, they can make unlimited fraudulent long-distance calls.

* Advise employees to be especially careful when making a credit card call at pay phones. Thieves eavesdrop for calling card codes. Sophisticated thieves use sensitive tape recorders, and even video cameras, to record the numbers.

* When using a pay phone at an airport or train terminal, try to use the ones that are arranged in a semicircle, rather than flat against the wall; they are harder for a thief to observe. Also, be sure the call is really terminated upon completion and the handset is replaced. Many times the card number stays in the phone's memory, and the next caller can piggyback onto the calling card.

* Beware of telephone calls to verify a credit card number. They are likely to be efforts to "steal" a code number.

Voice Mail Security

* Report all suspicious calls to the phone administrator, who should report them to the telephone company.

* Advise employees to report failed efforts to access a voice mailbox. It's possible a thief has gained entrance to the system, changed the number and is using the phone fraudulently.

* Busy voice mail numbers should be reported to the administrator. The system was designed to handle normal amounts of traffic; if the line is busy, it's possible the system has been illegally entered and the phone is being used fraudulently.

* Advise employees to use the full complement of digits for their voice mail codes. Many systems allow up to four or five digits, but for convenience some employees use fewer digits, making it easier to break the code.

* Warn employees against taping secret codes to computers or phones or storing them in desks. Codes should be memorized and changed frequently. Birthdays, Social Security numbers or home phone numbers should never be used as codes.

* Do not disarm security features on phone systems.