Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#61

Post by YXNjaGVyZWdlbgo »

em-bee wrote: post #60
YXNjaGVyZWdlbgo wrote: post #40

Earlier quoted context omitted.

You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

if twilio can not differentiate between inbound messages that are being forwarded and outbound messages that are created by the twilio customer then their service can't guarantee to be reliable because someone could basically create a DOS attack by sending spam to any twilio customer expecting that twilio will blame their customer and suspend the account.

It's not their job to differentiate they are just a carrier they scan for outgoing spam to protect their own core business and to not get blacklisted everywhere. Read the ToS they are pretty specific about it.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#62

Post by ChrisDutrow »

andrei_says_ wrote: post #39
gregorymichael wrote: post #18

Hey Chris, Greg from Twilio here. I'm so sorry for the frustration, lack of communication, and high friction to get this resolved. Want to drop me an email at gb@twilio.com and we'll see if we can get it sorted out?

Greg, it would be very useful if you could recommend a setup which would allow forwarding sms to employee numbers without the risk of account suspension. Many of us use twilio and an account suspension is an undesirable scenario. “Forward unless spam/problematic” would be very nice.

I just talked to Greg, he said something that might help would be to add "FWD: " before the forwarded message. Or possibly "Forwarded from XXX.XXX.XXXX: "

I can confirm that my system did forward the message without any modifications at all. (my employee knew what it was because he knows all text messages from that number are forwards)

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#63

Post by PeterisP »

howdydoo wrote: post #11

Auto-banning an account is a violation of GDPR Article 22 https://gdpr-info.eu/art-22-gdpr/ > The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Quote this and maybe it will get you escalated, but who knows? A lot of companies seem to just igno…

This is absolutely not applicable even if both parties were in the EU, a company can not be a data subject under GDPR (only "natural persons" are), any GDPR clauses about automated decisions (and others) protect only individuals and not B2B accounts.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#64

Post by _hyn3 »

YXNjaGVyZWdlbgo wrote: post #43
soco wrote: post #42

Earlier quoted context omitted.

And where are those people receiving the spam message in the first place? From Twilio's system right. If they are so good at detecting it circulating internally, why didn't they detect it and block it in the first place?

It is simply against the ToS to send spam over twilios network. Objectively this is what OP is doing. You are allowed to receive spam maybe your core business even depends on getting spam numbers or analyzes the spam for phishing links itself. You can receive and ingest it in anything you want you just can't send it over twilio yourself. Sorry this is not a design flaw this is just a bad workflow.

This is absolutely a Twilio design flaw.

It's an incredibly common use case to forward text messages from one incoming line to another number that is controlled by your company, and it's impossible to tell at the point of receipt (when it's still in Twilio's network) whether it's spam or not before forwarding it on.

It's the same exact thing that you might do if you have a support@example.com email address; it probably sends incoming emails to a number of different inboxes, even if those incoming emails are spam (and even if there actually is a spam system in place that might block some percentage of incoming messages, and Twilio doesn't even provide that.)

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#65

Post by mbreese »

YXNjaGVyZWdlbgo wrote: post #40
Turing_Machine wrote: post #38

Earlier quoted context omitted.

Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario unde…

You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

The are otherwise curating the data and calling it spam on the outbound, so… yes?

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#66

Post by jjnoakes »

onphonenow wrote: post #48
Xylakant wrote: post #26

Earlier quoted context omitted.

Twilio could fairly easily verify that the phone number owner consents: when setting up the recipient number, allow for double opt in - send a verification code that must be entered somewhere.

Twilio does not allow a user to "consent" to receive spam. This is specifically covered in their ToS by the way. "We never allow some types of content on our platform, even if our customers get consent from recipients for that content." This is for the simple reason that a lot of folks are using Twilio for application to person / transaction messaging - and the key to delivery quality is to have no crap content going…

> If you operate an open relay for email - your IP address is going to be blacklisted very quickly. Same here

This doesn't sound like an open relay (since the incoming message can't be forwarded to arbitrary destinations), this sounds like a mailing list. And if my mailing list was banned because someone else sent spam to it, I'd be upset too.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#67

Post by DyslexicAtheist »

gregorymichael wrote: post #18

Hey Chris, Greg from Twilio here. I'm so sorry for the frustration, lack of communication, and high friction to get this resolved. Want to drop me an email at gb@twilio.com and we'll see if we can get it sorted out?

hopefully you can find a way to solve this. Sounds like all somebody needs to take a business offline is the knowledge that they are using twillo (easy) and that they're forwarding texts to employees.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#68

Post by ChrisDutrow »

nawgz wrote: post #31

It's quite strange you forward the texts VIA text; why not ingest it in any other format? Slack, internal database, logs, ... Unfortunate outcome though. Automated banning is always frustrating.

I need the message to pop up on his cell phone just in case he is not at the computer.

Slack is probably a good idea.

Of course we have an internal database and he can look at text messages through our web application too. But these are not push notifications to his phone.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#69

Post by _hyn3 »

ChrisDutrow wrote: post #22
gregorymichael wrote: post #18

Hey Chris, Greg from Twilio here. I'm so sorry for the frustration, lack of communication, and high friction to get this resolved. Want to drop me an email at gb@twilio.com and we'll see if we can get it sorted out?

Ok I just e-mailed you, thanks so much

When a company has gotten so automated that the only way to get a solution is to beg and plead for help about it on social media, it's too automated.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#70

Post by ChrisDutrow »

techsupporter wrote: post #35

Where I work, we use Pushover ( https://pushover.net/ ) for this. A message comes in via SMS and then a handler stores it in a database then turns around, does some light filtering[0], and then sends a notification to a Pushover group. It's $5 per user per month for their teams feature, which we happily use. 0 - The handler doesn't send out via Pushover any message that contains words we're unlikely to use; Facebook…

Oh very cool, thanks for this suggestion. I think the outgoing text messages actually add up to be kind of expensive too so this could save some money.
Post reply on HN