Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#91

Post by Sohcahtoa82 »

YXNjaGVyZWdlbgo wrote: post #72
_hyn3 wrote: post #64

Earlier quoted context omitted.

This is absolutely a Twilio design flaw. It's an incredibly common use case to forward text messages from one incoming line to another number that is controlled by your company, and it's impossible to tell at the point of receipt (when it's still in Twilio's network) whether it's spam or not before forwarding it on. It's the same exact thing that you might do if you have a support@example.com email address; it probab…

Twilio is a carrier and nothing else by having zero tolerance against outgoing spam they are protecting their own core business. If OP or you in that regard would even glimpse at their ToS instead of just scrolling by when your business depends on it OP would not have made this user error.

What they're getting at is that Twilio clearly already has the capability of automatically detecting spam.

Why not open that capability to an API so that somebody who is operating some sort of forwarding service to run spam detection before forwarding?

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#92

Post by techsupporter »

_hyn3 wrote: post #71
techsupporter wrote: post #35

Where I work, we use Pushover ( https://pushover.net/ ) for this. A message comes in via SMS and then a handler stores it in a database then turns around, does some light filtering[0], and then sends a notification to a Pushover group. It's $5 per user per month for their teams feature, which we happily use. 0 - The handler doesn't send out via Pushover any message that contains words we're unlikely to use; Facebook…

Wonder if it runs on Twilio..

I don't know what the SMS service part of Pushover uses as we don't send SMS through Pushover. The part we use, the main feature, sends a notification through an app the user installs on their device. All of us who receive push notifications through our system have the Pushover app on our phones, some also have it on their tablets and computers.

I like the Apple Watch integration as I can interact with urgent notifications just on my watch without my phone handy.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#93

Post by YXNjaGVyZWdlbgo »

Sohcahtoa82 wrote: post #91
YXNjaGVyZWdlbgo wrote: post #72

Earlier quoted context omitted.

Twilio is a carrier and nothing else by having zero tolerance against outgoing spam they are protecting their own core business. If OP or you in that regard would even glimpse at their ToS instead of just scrolling by when your business depends on it OP would not have made this user error.

What they're getting at is that Twilio clearly already has the capability of automatically detecting spam. Why not open that capability to an API so that somebody who is operating some sort of forwarding service to run spam detection before forwarding?

Because they are not in the business of filtering spam they are in the business of receiving and delivering messages. The spam filtering outbound is to protect their own core service. Running spam protection for your own service is a lot different to offering spam protection for customers.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#94

Post by Turing_Machine »

YXNjaGVyZWdlbgo wrote: post #40
Turing_Machine wrote: post #38

Earlier quoted context omitted.

Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario unde…

You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

Umm... "curating the data" is exactly what they're doing when they ban the customer for forwarding spam that originated from their system.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#95

Post by YXNjaGVyZWdlbgo »

em-bee wrote: post #90
YXNjaGVyZWdlbgo wrote: post #61

Earlier quoted context omitted.

It's not their job to differentiate they are just a carrier they scan for outgoing spam to protect their own core business and to not get blacklisted everywhere. Read the ToS they are pretty specific about it.

but then they are simply not suitable for the use case of forwarding inbound messages because the risk is to great that i'll get shut down just because i am receiving spam.

Yes.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#96

Post by Turing_Machine »

jaywalk wrote: post #86
Turing_Machine wrote: post #36

Earlier quoted context omitted.

No, someone else sent a spam message into Twilio's system, and, rather than dropping it on the floor, Twilio's system then forwarded the spam on to their customer's list, then blamed the customer for it.

Nope, that's not how Twilio works. Yes, someone else sent a spam message, but Twilio did not forward it to "their customer's list" whatever that means. Twilio forwarded it to their customer's application , which was the end of the line for Twilio. At that point, their customer's application sent out that spam message to whoever was configured to receive it. As far as Twilio is concerned, the incoming and outgoing mes…

That's a distinction without a difference.

By their own policy, Twilio's upstream should ban them for "forwarding spam".

I'm guessing they would not be happy if that policy were applied.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#97

Post by chc »

YXNjaGVyZWdlbgo wrote: post #93
Sohcahtoa82 wrote: post #91

Earlier quoted context omitted.

What they're getting at is that Twilio clearly already has the capability of automatically detecting spam. Why not open that capability to an API so that somebody who is operating some sort of forwarding service to run spam detection before forwarding?

Because they are not in the business of filtering spam they are in the business of receiving and delivering messages. The spam filtering outbound is to protect their own core service. Running spam protection for your own service is a lot different to offering spam protection for customers.

If you're going to hold people responsible for meeting a metric, you need to ensure they have a way of measuring the thing in question. To do otherwise is unreasonable by definition. If Twilio's definition of "sending spam" matched the OP's, where it's about sending messages the user did not agree to receive, then that would be reasonable. But instead it's something more intangible.

And like you say, they do need to prevent their system being used for sending spam. But if they're not going to provide a way for honest parties to avoid sending spam, they need to be reasonable about how they react to spam reports.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#98

Post by ewoodh2o »

This is really frustrating, and sorry you're on the receiving end of this. I don't work for Twilio, but we spend a lot with them (and some other telecoms) so I see a bit further up the chain than most.

The retail wireless carriers are really driving a lot of this with recent 10DLC A2P changes. In particular, T-Mobile is waving around threats of $10k fines per message for messages they deem to be in violation of their content rules. (Which obviously prohibit fraud and such, but also somewhat-arbitrarily anything relating to marijuana.) The way it's written T-Mobile will fine Twilio, who is supposed to pass it on, but knows they'll struggle to collect that.

Meanwhile, on my personal cell phone AT&T can't even seem to figure out that when they get a message from a Nexmo number that starts with "ATT Free Msg" that they didn't send, maybe they shouldn't deliver it. As a consumer I'm glad someone is trying to squash these scams, but they're breaking more than a few eggs in the process.

I'd echo the advice to get off the SMS channel for notifications if at all possible, unless you're sending enough and spending enough to have named support contacts. The rules are being written for people sending thousands of messages per day. We serve small businesses who send maybe 100 messages per month, and it's been a mess trying to get carriers to recognize that these businesses exist and need a solution that works for them too.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#99

Post by toss1 »

No experience with Twilio, but yours makes me glad that's not the case.

As another small biz, I've had very good experience with Phone.com over the past several years. Prompt and solid tech support the few times I need it (mostly for configuration and 'is there a way to do this peculiar thing?' questions), and mostly just works.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#100

Post by [deleted] »

onphonenow wrote: post #45
Turing_Machine wrote: post #32

Earlier quoted context omitted.

If Twilio can detect that it's spam, surely the correct procedure would be to block it when it first comes into Twilio's system from outside, not blindly forwarding it to a customer's list and then blaming the customer for it! Sorry, this is just bad design. Re: > The customer may want to handle / filter the spam. Then provide the customer with a "yes, send me all the spam" option. Which do you suppose is the common…

False. The customer may want to handle / filter the spam. The customer may be do a study of spam. The customer may be offering their customers a spam blocking service. Fine to provide an option to filter it perhaps, requiring twilio to block what it THINKS is spam is a recipe for disaster, spam filters are no where near perfect.

[deleted]
Post reply on HN