He installed a small switch between the payphone and the line before it went into the ground. He then exploited the lack of coordination between the phone and the exchange.
* First he would pick up the phone and start dialing 0800 (equivalent of 1-800), the phone would see this was a free number and ignore what was being entered next.
* Then he would briefly interrupt the line. The phone wouldn't notice but the exchange would think the call had ended.
* Then he would dial a new number. The exchange would think the payphone was making sure he paid, while the payphone would think he was still dialing a free number.
So to call 0900 123 456 for free he would dial 0800-click-0900123456
Obviously the phone company audits quickly turned up a problem but he got away with it for a little while.