I used to program call centers. Some of my call centers got several dozen calls a second. With one subtle change in a script, I could route any of those calls anywhere. Even to someone's home number. I was really ticked off at one BBS for many years, and had little revenge fantasies about rerouting just a slim percentage of those calls to the sysop and some of his buddies. When you have dozens of T3 trunks sending dozens of calls a second, .001% of those calls could mean once every few minutes, it would dial out from a data switch (untraceable unless the telco spends weeks, even months trying to figure out where the calls are coming from) to a phone number anywhere in the US and Canada. I could even have a loopback "request confirmation from switch" so that the actual customer call would not get through (unless the receiving number had a switch that would send confirmations), and change the confirmation to any S7 code on the end victim's telco switch. What does this mean?
The victim would have gotten a call randomly every few minutes to an hour (depending on call volume at that time of day) that where he picked up, he'd get "**DOO DEE DEET: We're sorry, but you must first dial a ONE when making this call. Please hang up and try the number again..." or any other standard message I selected. I could even change the caller ID string to any number, like say the number of another guy I was mad at. Ha ha. That would drive them nuts. And the clueless telco on his end would probably have no idea why this was happening. Sure, a savvy technician who had a lot of time on his hands who gave a damn could find out eventually it came from our switch, but then we could go, "Wow ... no idea how that would have happened, maybe someone fat-fingered a phone number in the script." But most normal phone customers won't even get that far. They'll probably get a shrug, blown off, or a resolution for both parties to change phone numbers, and they usually force the customers to pay for that themselves.
Ya'll are lucky I have morals.