This sounds like the 'phone phreaks' of the late 1970s that morphed into the hackers of the 1980s and 1990s. This is written up in various hacker books on social engineering and reverse engineering, some of which are very entertaining and also a wake-up call. '2600 Magazine' tends to document 'sitting duck' installations - generally companies and government organizations that should make at least a trivial effort to implement security.
Among some of the 'illegal' acts recorded in 2600 were the reprint of store coupons with higher discount amounts that the originals they were copied from, carrying around laptop sniffers in backpacks outside of retail stores that had unencrypted wireless Point-of-Sale equipment transacting credit cards, and staff that had never been trained to recognize social engineering. In short, such companies left themselves open to hacks. Often the people that did it first were simply curious, and did nothing more damaging than publish what they found. Situations that resulted in serious damage tended to occur later, and were only identified by law enforcement after either millions were stolen or millions of customer accounts were compromised.
It is not necessarily a good idea to indicate that 'you did it', however those interested in the 'dark side' often go to hacker meets where such matters are discussed. The times and places of these meetings are often documented in 2600 magazine - such meetings might be held in food courts in malls.
** Social Engineering ** If one has successfully 'socially engineered' account extraction from clerks in multiple businesses and local governments, this would be presented on a CV as 'local hacker consensus is that organizations in the area have not trained staff in social engineering practices'. One would reference 'The Art of Deception: Controlling the Human Element of Security' by Kevin Mitnick to document examples.
** Unprotected Infrastructure ** If one has a nose for sniffing out unprotected infrastructure, one would reference this on the CV as 'repeated scans of IP addresses within the US have determined that 70% of embedded systems (i.e., machine tools, refinery controllers, or water utility valves) have no password or firewall protection'. A link to this article would be attached, at least in the PDF version.
** Obsolete Business Practices ** Bar coded coupons are basically 'sitting ducks'. It is trivially easy to scan a coupon, print the copy on a color laser printer, and regenerate the bar code with a higher discount. The bar coding software is either 'free' or can be had for trivial cost, particularly if one can get 'their money back' in applying discounting technology 'creatively'. This would appear on the CV as 'ability to demonstrate alteration or interception of encoded artifacts (coupons, cash cards, etc.) using published examples'. In such circumstances one doesn't say that they did it, they just indicate that were someone to follow certain instructions published in magazines, the potential employer's resources could be compromised.
Much of the reason 2600 exists is that the publishers find open doors wherever they look. This is as much about warning people to cover their assets as it is instructing hackers in their craft.