It's quite strange you forward the texts VIA text; why not ingest it in any other format? Slack, internal database, logs, ...
Unfortunate outcome though. Automated banning is always frustrating.
Ask HN: Twilio suspended account because someone sent us a fraud text
31–40 of 207 posts
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#32Earlier quoted context omitted.
It seems to effectively be forwarding the text messages, like an SMS mailing list. If Twilio can't deal with forwarding messages as they come in, no matter the content, it's their problem.
I'm actually very glad Twilio doesn't allow itself to be used for SMS spam. I hate SMS spam. Twilio doesn't know that these are "employees".
If Twilio can detect that it's spam, surely the correct procedure would be to block it when it first comes into Twilio's system from outside, not blindly forwarding it to a customer's list and then blaming the customer for it!
Sorry, this is just bad design.
Re: > The customer may want to handle / filter the spam.
Then provide the customer with a "yes, send me all the spam" option.
Which do you suppose is the common case here?
1) Customer doesn't want spam.
2) Customer is doing a "study of spam"
3) Customer is running a spam filtering service.
Yeah, it's 1), dude, in a gigantic majority of the cases.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#33> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…
This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that original number. The business case of relaying inbound text messages to an employee's phone number should be a very common one and should not warrant an account suspension.
The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you are looking at the problem objectively twilio is in the right.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#34> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…
There are two layers here. 1) You're absolutely right that the account ends up texting out a phishing link which any automated system would rightfully detect as phishing (regardless of whether the recipient has "consented" to receiving the message - it still contains a phishing link). But that's not the real issue, which is 2) Twilio's response to detecting the sending of a phishing link (possibly more than one) is to disable an entire account with no timely recourse from the affected account holder who may be running a legitimate business.
I don't think anyone is arguing that Twilio was wrong to detect the message as spam. It's more that an unexpected side-effect of the customer's current implementation had outsized consequences. Similar unexpected friction with Twilio's anti-spam mechanisms are likely to occur again and they will cause outsized damage to this legitimate business or others if Twilio doesn't change their strategy.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#35Where I work, we use Pushover (https://pushover.net/) for this. A message comes in via SMS and then a handler stores it in a database then turns around, does some light filtering[0], and then sends a notification to a Pushover group. It's $5 per user per month for their teams feature, which we happily use.
0 - The handler doesn't send out via Pushover any message that contains words we're unlikely to use; Facebook is one, for example. If a message isn't forwarded via push notification, it is emailed to the sysadmin list for one of us to manually look at during daytime hours.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#36Not excusing their lack of support, but at the end of the day you sent a spam/phishing message through their service. What exactly are they supposed to do? If they don't immediately shut down accounts that send these messages, they're going to be in hot water with the cellular carriers. It's by far the lesser of two evils to just shut down accounts that send spam.
No, someone else sent a spam message into Twilio's system, and, rather than dropping it on the floor, Twilio's system then forwarded the spam on to their customer's list, then blamed the customer for it.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#37> I should be considering bearing in mind that it would be expensive to re-write the software to work with another vendor Well, maybe next time you get somebody that implements a standard. With that kind of behavior (not letting you speak to anybody, the blocking is understandable), it's clear you shouldn't keep their services. So, you have now an opportunity to do it right, and make the next move cheaper.
There isn't a standard for these apis though
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#38Earlier quoted context omitted.
This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that original number. The business case of relaying inbound text messages to an employee's phone number should be a very common one and should not warrant an account suspension.
The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…
Here's what's happening, as I see it (corrections welcome):
1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer.
Sorry, there is no scenario under which this is the customer's fault.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#39Hey Chris, Greg from Twilio here. I'm so sorry for the frustration, lack of communication, and high friction to get this resolved. Want to drop me an email at gb@twilio.com and we'll see if we can get it sorted out?
Greg, it would be very useful if you could recommend a setup which would allow forwarding sms to employee numbers without the risk of account suspension.
Many of us use twilio and an account suspension is an undesirable scenario.
“Forward unless spam/problematic” would be very nice.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#40Earlier quoted context omitted.
The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…
Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario unde…
You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.