Squawk 7500 on an aircraft transponder and air traffic control knows the plane has been hijacked. Civilian and commercial aircraft use that code as a duress signal, and airlines keep a verbal hijack code as well.
A duress code is any covert signal sent by someone being coerced, a way to tell others they are acting against their will. It can be a word or phrase dropped into ordinary conversation. It can also be built into authentication, as a panic password or duress PIN that differs from the user’s normal one. Both work much like a panic alarm.
Alarms, ATMs and phones
Some home and property alarm systems use a duress PIN made by swapping the last two digits of the reset code. Punch it in with an intruder standing over you and a silent alarm alerts police or security. The feature has been controversial, since it has been blamed for false alarms.
A similar idea, SafetyPIN, was proposed for ATMs. In 2010 the Federal Trade Commission studied whether it could work. Its report found that no duress PIN had ever been put into use in any ATM, and it concluded that the cost of deploying one outweighs the chance it would deter crime.
Phone calls offer another route, though a slim one. A captor who lets a victim phone a relative, say to get a PIN, is probably listening, so the signal has to be short and subtle. Ideally the family member or friend has agreed on it beforehand and can tell police something is wrong. One example is asking, “What is Cindy barking at?” when the dog has another name or there is no dog. Calling 911 and pretending to order pizza is a widely shared urban legend, but it did happen once, in Brazil.
Duress activity is a quieter cousin. A person might pull cash from an ATM with a specific credit card instead of a debit card, which can fire off an email alert from the card company. Delayed notification, patchy cell coverage and the fact that only the activity is reported, not the location, all get in the way.
Where the schemes break
The silent-alarm version has a weak spot. An adversary can demand the PIN in advance and make sure the altered one is entered. Even an attacker who doesn’t know which of the two codes is real can guess and be right half the time.
Panic passwords that restrict access instead of raising an alarm fare worse. One is not enough, because an attacker who knows the system can make the user authenticate twice with different passwords and get in on at least one try. More elaborate schemes have been proposed to close that gap.
In phone software
GrapheneOS, a mobile operating system, has a duress PIN. Entering it makes the phone factory reset. In 2026 an American man was charged with destroying property to prevent seizure, after prosecutors said he used a GrapheneOS phone and gave Customs and Border Protection officers a duress PIN when they held him at an airport. The Guardian reported it as the first case of the law being used against an operating-system-level duress code.
Older uses
SOE agents in occupied Europe in World War II used a phone code. Asked whether a visit to a safe-house was convenient, an agent would say “No, I’m too busy” if all was well. “Yes, come on over” meant the house had been taken and the person answering was under guard.
The Englandspiel is the best-known case of a duress signal being ignored. Captured Dutch agent Huub Lauwers put deliberate errors in his messages to show he had been turned. The missing security checks were overlooked, the Germans compromised SOE operations in Holland, and 50 of the 54 agents sent in were killed.
In 1968 North Korean forces captured the USS Pueblo and held its crew for 11 months. In staged propaganda photos, the sailors secretly gave the camera “the finger.” During the Vietnam War, captured Admiral Jeremiah Denton blinked the word “TORTURE” in Morse code during a televised propaganda broadcast.
