Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio blocked our account and with it hundreds of our customers [resolved]

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 165 posts

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#71

Post by ksajadi »

smhg wrote: post #31
ksajadi wrote: post #29

Sorry to hear. Twilio has changed since its early days. Last month, our bill went from $20 per month to $16,000. The reason: fraudsters use Twilio to setup premium numbers, then use Twilio customers (like us) to send OTPs to those numbers using bots. The result is us out of pocket, fraudsters and Twilio making money. Twilio is also the only Pay as you Go SaaS vendor that doesn’t have spend limits on accounts and advi…

FWIW: you can turn off automatic recharge and ask for a different reminder limit. Not ideal, but at least it prevents crazy bills.

We didn't have automatic charge. We now have an invoice to pay.

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#72

Post by ksajadi »

plasma wrote: post #63
ksajadi wrote: post #29

Sorry to hear. Twilio has changed since its early days. Last month, our bill went from $20 per month to $16,000. The reason: fraudsters use Twilio to setup premium numbers, then use Twilio customers (like us) to send OTPs to those numbers using bots. The result is us out of pocket, fraudsters and Twilio making money. Twilio is also the only Pay as you Go SaaS vendor that doesn’t have spend limits on accounts and advi…

I've only briefly played with Twilio, but would it be possible for your app/TwilML to intercept the request to send a text to those numbers, and detect a volume of X messages being sent to the same number (highly unlikely) and abort?

That's one of their recommendations. So the idea of Twilio is just drop a library and we take care of telephony for you, but then they suggest you implement cooldown periods, exponential backoffs, use their other services (paid) to check if the number is a mobile etc. And they tell you this, after you get the nasty bill.

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#73

Post by akudha »

blowski wrote: post #38
holoduke wrote: post #25

Welcome to the new world where tech companies rule. Where moral standards are gone. Where local laws do not apply. This shit is happening a lot. Artists on Youtube, App builders on Playstore/iOS. Marketing companies on Google search, pretty women on Instagram, political men on Facebook or Twitter. I feel for you. Hope it gets alright.

Remove the tech-specific words from your comment, and you would probably find people saying the same thing throughout all of history.

That might be true, but nobody in history had as much power/reach as these tech companies.

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#74

Post by t0mas88 »

roblabla wrote: post #60
ovi256 wrote: post #43

Earlier quoted context omitted.

The fraudsters setup premium numbers with some other telephony provider, possibly in another country. Then they use those numbers to receive 2FA (two factor auth) passwords (either SMS or read aloud in calls). Because the defrauded party's servers called those premium numbers through Twilio, the defrauded party has to pay Twilio. AFAIK there's no easy way to always, securely detect premium numbers. The fraudster can…

The real fraud here seems to be the telephony industry's concept of a premium number. That there isn't an enforced standardized way to tell that a phone number will incur extra fees to contact is a failure of the industry. This shouldn't be a hard problem.

There is such a system, countries are supposed to report all premium number ranges to the ITU. The problem is that some countries/carriers don't actually do that and then still charge the high amount.

If Twilio wanted to stand up for their customers they would refuse to pay for any premium number that's not in an ITU registered premium range. It will cause a few lawsuits with telecom carriers, but then probably ends this problem once and for all.

Twilio claims this isn't possible, but most mobile operators offer an option to disable calling premium numbers. So either the providers are very customer friendly and eat the cost (unlikely, it would open them up for huge amounts of fraud) or the mobile operators figured out how to block it or push the cost back to the upstream provider.

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#75

Post by blowski »

akudha wrote: post #73
blowski wrote: post #38

Earlier quoted context omitted.

Remove the tech-specific words from your comment, and you would probably find people saying the same thing throughout all of history.

That might be true, but nobody in history had as much power/reach as these tech companies.

The East India Trading Company. Rockefeller.

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#76

Post by [deleted] »

ovi256 wrote: post #43
Rastonbury wrote: post #41

Earlier quoted context omitted.

How the the fraudster make money, not familiar with the concept of premium numbers. EDIT: Oh premium numbers charge the sender

The fraudsters setup premium numbers with some other telephony provider, possibly in another country. Then they use those numbers to receive 2FA (two factor auth) passwords (either SMS or read aloud in calls). Because the defrauded party's servers called those premium numbers through Twilio, the defrauded party has to pay Twilio. AFAIK there's no easy way to always, securely detect premium numbers. The fraudster can…

[deleted]

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#77

Post by blowski »

ksajadi wrote: post #70
blowski wrote: post #40

Earlier quoted context omitted.

That's painful for you, but a good thing to know as a community. Is it possible to prevent sending to premium numbers?

Yes, but it adds insult to injury. One of the suggestions by Twilio is to use their service to check the number and send only to mobile numbers. The issue? Twilio charges per call for that service! So you pay them to "possibly" stop you paying them more and fraudsters. The whole thing stinks

Is there some kind of regex for premium rate vs standard numbers?

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#78

Post by TakuYam »

blowski wrote: post #75
akudha wrote: post #73

Earlier quoted context omitted.

That might be true, but nobody in history had as much power/reach as these tech companies.

The East India Trading Company. Rockefeller.

Genghis Khan, Alexander of Macedonia

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#79

Post by BuildTheRobots »

ovi256 wrote: post #43
Rastonbury wrote: post #41

Earlier quoted context omitted.

How the the fraudster make money, not familiar with the concept of premium numbers. EDIT: Oh premium numbers charge the sender

The fraudsters setup premium numbers with some other telephony provider, possibly in another country. Then they use those numbers to receive 2FA (two factor auth) passwords (either SMS or read aloud in calls). Because the defrauded party's servers called those premium numbers through Twilio, the defrauded party has to pay Twilio. AFAIK there's no easy way to always, securely detect premium numbers. The fraudster can…

> the fraudsters can set up a forward from a normal number to a premium number

Doesn't this mean that your call from Twillo to the normal number would be charged at your usual rate, and the fraudster would pick up the cost for the forwarding?

Re: Twilio blocked our account and with it hundreds of our customers [resolved]

#80

Post by scrollaway »

ovi256 wrote: post #43
Rastonbury wrote: post #41

Earlier quoted context omitted.

How the the fraudster make money, not familiar with the concept of premium numbers. EDIT: Oh premium numbers charge the sender

The fraudsters setup premium numbers with some other telephony provider, possibly in another country. Then they use those numbers to receive 2FA (two factor auth) passwords (either SMS or read aloud in calls). Because the defrauded party's servers called those premium numbers through Twilio, the defrauded party has to pay Twilio. AFAIK there's no easy way to always, securely detect premium numbers. The fraudster can…

Sucks. But then again, anything that puts a nail in the coffin of SMS/Voice call 2fa, probably for the best. I feel bad for the genuine uses of phone tech that are targeted though.
Post reply on HN