Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

11–20 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#11
Auto-banning an account is a violation of GDPR Article 22

https://gdpr-info.eu/art-22-gdpr/

> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Quote this and maybe it will get you escalated, but who knows? A lot of companies seem to just ignore GDPR entirely.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#12
My thought is that for any business-critical service, you need to have bought the service from person-to-person sales channels. Many boring meetings where they walk you through a slideshow of their service even though you already have it working. Many meetings worth of negotiating a price that's 10x the off-the-shelf price. All instead of, you know, making your product. It's just the cost of doing business -- $5/user/month if you're ok with them shutting you down because of a malfunctioning cron job, $30,000/year + meetings if you want someone's email that has to look into your problem. That's how software is these days, and unfortunately, literally everyone wants a piece. No task is too trivial to justify a 5 figure yearly cost, it seems. (Most recently, a well-known company tried to get that much out of me for hosting a static website!) There doesn't seem to be any market pressure to correct this problem, and I don't really understand why, but someone stands to make a lot of money if they crack the code. In the meantime, there's you and a problem, and giving the vendor your time and money can get the problem resolved. (Yup, you have to reward someone that's wronged you, because you already wrote code against their proprietary API. That's just how it is these days, and you have to accept it if you want to get anything done.)

I agree with the other comments that relaying phishing to internal users is probably what they dislike. There, of course, isn't a good solution beyond using some open platform. Your self-hosted IRC server isn't going to cancel your account because someone sent a phishing link, for example. But, nobody will know how to connect to it anyway. Sigh!

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#13
post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that original number.

The business case of relaying inbound text messages to an employee's phone number should be a very common one and should not warrant an account suspension.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#14
post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

It seems to effectively be forwarding the text messages, like an SMS mailing list. If Twilio can't deal with forwarding messages as they come in, no matter the content, it's their problem.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#15

For an alternative, maybe relay the texts to a slack channel (that's easy enough to receive on a phone for your coworkers). Zapier can probably integrate twilio/slack quickly.

Yes, I will do something like this. However it doesn't alleviate the overarching concern that they are behaving in a way that treats my business very recklessly.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#16
post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

I have set up a few twilio accounts like this where a business number blindly forwards to the business owner's personal cell, maybe some logic for business hours and holidays. If twilio wants us to start filtering spam messages for these cases, they need to give us the API/tooling. Or let us pre-register receiving numbers through an opt-in process. I understand Twilio not wanting to be an open relay but the reported…

Yes or they could have just blocked the messaged before it hit my system. They are the ones that originally allowed the message to get to me. Then when I process it, they suspend my account.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#17
post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

It seems to effectively be forwarding the text messages, like an SMS mailing list. If Twilio can't deal with forwarding messages as they come in, no matter the content, it's their problem.

I'm actually very glad Twilio doesn't allow itself to be used for SMS spam. I hate SMS spam. Twilio doesn't know that these are "employees".

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#19

My thought is that for any business-critical service, you need to have bought the service from person-to-person sales channels. Many boring meetings where they walk you through a slideshow of their service even though you already have it working. Many meetings worth of negotiating a price that's 10x the off-the-shelf price. All instead of, you know, making your product. It's just the cost of doing business -- $5/user…

I kind of agree with this. I need to have that point-of-contact, so that if something blows up, they don't want to lose their commission, so they email the right person in the company to get it fixed.

The thing is, I actually had this when I first started with them. They were so small at the time, that I had one of the founders on the phone once and he told me all about how he studied cloud computing at MIT. But this was over 10 years ago. After that, they had phone support for a long time.

Last few years they changed over to this way where there is no path to resolving a problem like this, which should be easy to solve, in an appropriate amount of time.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#20

Auto-banning an account is a violation of GDPR Article 22 https://gdpr-info.eu/art-22-gdpr/ > The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Quote this and maybe it will get you escalated, but who knows? A lot of companies seem to just igno…

GDPR can only be enforced for citizens in the EU/EEA and (for now) the UK. I think the OP is based in the US as is Twilio.
Post reply on HN