Cordless phone BUG
The material presented on this page is for educational purposes only. The author does not practice or endorse the monitoring of telephone conversations in any manner, as it violates Federal law. What this page provides is information - how it is utilized by the reader after they leave this website is their responsibility.
All contribution to this page are most welcome!


Background
Many Cordless phones are still analogue and use the frequency from 30-50MHz. The signal is FM-modulated and can easy be picked up with any FM-receiver. I will present a FM-receiver wich can be adjusted within this frequency range.
The cordless phones can have different number of channels. In the oldest type you will find a single crystall (one channel). The multi-channel phones uses a synthesizer chip to set a frequency wich is not occupied.
The receiver I present is not crystall controlled. The receiving frequency is set manually by a potensiometer. This way you can easy find any signal within the frequency range.


Scheamtic
Click on the image to view the full schematic of the amplifier.
I will not attach a PCB to this construction, because it is so easy to make one yourself.

 

46/49 Mhz Cordless Phone Frequencies

All frequencies are displayed in base / handset format.

10-Channel System


01 - 46.610 / 49.670

06 - 46.770 / 49.830

02 - 46.630 / 49.845

07 - 46.830 / 49.890

03 - 46.670 / 49.860

08 - 46.870 / 49.930

04 - 46.710 / 49.770

09 - 46.930 / 49.990

05 - 46.730 / 49.875

10 - 46.970 / 49.970


6-Channel System

01A - 49.930 / 1.695

06A - 49.830 / 1.705

13A - 49.860 / 1.765

19A - 49.875 / 1.795

25A - 49.890 / 1.825

27A - 49.845 / 1.735

25-Channel System



01 - 43.720 / 48.760 14 - 44.460 / 49.460
02 - 43.740 / 48.840 15 - 44.480 / 49.500
03 - 43.820 / 48.860 16 - 46.610 / 49.670
04 - 43.840 / 48.920 17 - 46.630 / 49.845
05 - 43.920 / 49.020 18 - 46.670 / 49.860
06 - 43.960 / 49.080 19 - 46.710 / 49.770
07 - 44.120 / 49.100 20 - 46.730 / 49.875
08 - 44.160 / 49.160 21 - 46.770 / 49.830
09 - 44.180 / 49.200 22 - 46.830 / 49.890
10 - 44.200 / 49.240 23 - 46.870 / 49.930
11 - 44.320 / 49.280 24 - 46.930 / 49.990
12 - 44.360 / 49.360 25 - 46.970 / 49.970
13 - 44.400 / 49.400

Six-channel systems are pre-1984, and are all but obsolete.  They differ from the other systems in that they use radio spectrum just above the AM radio band for the base transmit frequency.  An AM radio slighly detuned or shortwave receiver is all it takes to capture a signal from one of these, and their transmit range can be quite good.

Ten-channel systems became available around 1985 and replaced the AM mode used in the base with FM.  They offer better clarity, less noise, and a range of about 1000 feet or so, although under ideal conditions the signal can go much farther.

Twenty-five channel systems came out around 1995-1996 after the FCC opened up additional   frequency space to relieve the overcrowed ten-channel systems.  They keep the original channels from the ten-channel system (now setup as channels 16-25), and added fifteen new ones using the 43, 44 and 48 Mhz bands.  They offer the same basic range, with the only difference being the expanded selection of channels.

Because cordless phones operate on the lower end of the VHF spectrum, those rubber duckie antennas that ship with most handheld scanners are usually not enough to tune this band (unless you are right nextdoor to the base unit).  A telescoping antenna is your best bet (Radio Shack #20-006 works fine).  Hobbyists on a budget - check the portable homebrew antenna on the main scanner page.

For the real dedicated listener, consider purchasing good quality low-band antenna, such as the Grove Scanner Beam, the
Channel Master 5094A, or the new 46 MHz antenna from Cellular Security Group.

It is the base frequency that needs to be tuned in to hear both sides of a conversation.

The handset frequency only provides audio coming from the handset itself, but can be very useful in helping you identify the source house that the call originates from if you own a handheld scanner.  Once you have locked onto a call on the base frequency, punch up its handset counterpart.  If the signal is weak, the call is probably not real close.  By walking the vicinity, the signal should get clearer as you near the handset's signal.  At this point, you either switch to the rubber duckie antenna, or completely remove all antennas and continue walking.  The signal will probably get snowy again, but will clear up when you are right on top of the source house.  Please note: many cordless phones will scan all channels for the least amount of interference, and then select one before giving dialtone or answering a call.  If you pinpoint a specific frequency as coming from a particular neighbor, odds are that the frequency will be different next time they pick up the phone.

Brief buzzsaw or chopping noises heard on the base frequencies usually indicates that an incoming call is being received (the base is ringing the handset).  Stay on this channel - you should hear someone answer shortly.

Some 46/49 Mhz models use voice-scrambling to maintain the privacy of the individual.

Cordless phones advertising 320,000 security codes to prevent unauthorized listening mean nothing to a scanner.  These codes only prevent other cordless phones from listening in - even a baby monitor receiver can tune in these channels in most cases.





Back to main Page  |  Contact Me  |  Cheap components

Copyright © Last modified on 5th June 2001.