Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

111–120 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#111

Earlier quoted context omitted.

The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…

Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario unde…

...or the complaints that caused the account suspension didn't come from Twilio. More than likely, the employee cell carrier noticed the spam and sent an automated complaint to Twilio, and then Twilio acted.

That doesn't excuse poor support, and the lack of resolution, but it changes a lot of the assumed processes.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#112
post #42

Earlier quoted context omitted.

And where are those people receiving the spam message in the first place? From Twilio's system right. If they are so good at detecting it circulating internally, why didn't they detect it and block it in the first place?

It is simply against the ToS to send spam over twilios network. Objectively this is what OP is doing. You are allowed to receive spam maybe your core business even depends on getting spam numbers or analyzes the spam for phishing links itself. You can receive and ingest it in anything you want you just can't send it over twilio yourself. Sorry this is not a design flaw this is just a bad workflow.

[deleted]

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#113

Hi Chris - CEO of Twilio here. I'm sorry for the issue. Fighting bad actors sucks, but we can do better to communicate with good faith builders like yourself. Mind sending me a note with your account at jeff@twilio.com, and I'll escalate for you.

A request from a random HNer – could you also commit to observing what the user's interactions with your customer service have been so far; and improving each of those, instead of nebulously "escalating" (where people will unblock an account because the CEO mandated it from up on high)?

Otherwise, you are contributing to a pattern where HN becomes de facto Tier 1 Customer Service, similar to how Twitter was a few years ago. This is already the case for various Google services [1], but I would hope that we don't want to normalize it for every service.

----------------------------------------

[1] A familiar pattern to most of us – Ask HN: Google suspended my account without warning; Googler escalates internally; problem is solved

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#114
post #42

Earlier quoted context omitted.

The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…

And where are those people receiving the spam message in the first place? From Twilio's system right. If they are so good at detecting it circulating internally, why didn't they detect it and block it in the first place?

> From Twilio's system right.

Do we know this? I don't think OP has clarified - they just said it goes to an "employee's phone number", which makes me assume it goes out to their personal phone number which is probably not on Twilio. If that's the case I'm wondering if Twilio received some kind of complaint from the employee's carrier that they forwarded the message too, rather than detected it themselves.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#116
post #64

Earlier quoted context omitted.

It is simply against the ToS to send spam over twilios network. Objectively this is what OP is doing. You are allowed to receive spam maybe your core business even depends on getting spam numbers or analyzes the spam for phishing links itself. You can receive and ingest it in anything you want you just can't send it over twilio yourself. Sorry this is not a design flaw this is just a bad workflow.

This is absolutely a Twilio design flaw. It's an incredibly common use case to forward text messages from one incoming line to another number that is controlled by your company, and it's impossible to tell at the point of receipt (when it's still in Twilio's network) whether it's spam or not before forwarding it on. It's the same exact thing that you might do if you have a support@example.com email address; it probab…

> it's impossible to tell at the point of receipt (when it's still in Twilio's network) whether it's spam or not before forwarding it on.

That OP mentioning "reprogramming the system so it doesn't forward messages" makes me think that they are receiving the incoming messages programmatically via webhook and then using Twilio API to send a new message with same text to new number (their employee).

In such a case, they do have a point in the process where they can implement some kind of filtering or processing (maybe stripping or obfuscating URLs?)

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#117

Earlier quoted context omitted.

I did mitigate the problem last time. I communicated with them and they told me it was fine. I'm very curious. Is this a communication mistake? Like do you think I'm some big company that forwards text messages to random people? Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so. Your question abo…

It's not even good business practice you are paying for something that is essentially free if implemented in every other way. This is not creative this abusing a system going against their ToS and blaming them for your own failure. I am suggesting you ingest the received messages and distribute it any other way like a lot of twilio customers probably do. This is merely a hack and a bad one at that.

No post body was provided.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#118
We were paying them around $1500/mo and had a similar issue where they blocked some (in our case) legitimate messaging traffic. We switched most of our traffic to another provider and are pleased. We had been a Twilio customer since 3 days after they launched and I owned a significant amount of their stock. I sold it all when this happened in spring of last year and I'm glad I did... stock has gone down significantly since. I don't see Twilio doing well long term, they provide an API for a network they don't own.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#119
UPDATE:::::

Due to Greg from Twilio seeing this post and providing me a way to reach out, I was able to get the problem resolved.

He spent about an hour on the phone with me today and provided some more information about the issue. A few highlights:

* Twilio has doubled in size since the beginning of the pandemic * Spamming and phishing through text message has gotten a lot more common very recently.

These two things together caused a sort of novel situation with them having to either auto-ban accounts of ban accounts with only a very shallow look and then not having a way for someone to get the account un-banned in a timely manner.

My initial concern with this post was that something had changed within the company culture where they were willing to cull off "smaller" accounts like mine in the $10,000 a year range by treating them very recklessly so that they only needed to work with very large companies which would be more simple and more profitable. This would mean that I would need to change providers or risk them doing other damaging things in the future that I would not be able to predict.

Based on a few things that Greg said in the conversation, I no longer believe this to be the case for a few reasons:

1) They have people like Greg reaching out to people like me at all. 2) In case Greg was not available the next time something like this happened, he provided me the contact information of some other people who were kind of high up in the company and explained that they would be very concerned that something like this was going on where legitimate customer accounts were being suspended.

This changed my interpretation of the situation because Greg's actions communicated to me that this is a temporary problem having to do with Twilio increasing in size very quickly at the same time spam and phishing became a big problem. They had to scramble to fix a problem with their providers before having a chance to refine their systems to make sure the implementation was done fairly and correctly. It does not seem to be a problem with top-level executives deciding that customers like me don't matter.

I also own a company and am very familiar with how things can get out of hand very quickly when demand increases. Shit hits the fan, then things suck for a while until the work is put in to become more organized. This takes time. And it takes trial and error.

I would expect over time for them to correct their systems and properly service smaller mid-range customers like me.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#120
Why misdirect from the real issue just to rally an internet mob in your favor? The problem clearly isn't that you received a fraud text (as the title suggests), it is that you SENT fraud texts using Twilio. That will obviously get you banned from any mainstream service.

Also:

> I don't need tech support, I just need someone to call, explain the situation to, and have them click a button.

What do you think tech support is?

Post reply on HN