Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#131

Post by ChrisDutrow »

quadrifoliate wrote: post #113
jeffiel wrote: post #110

Hi Chris - CEO of Twilio here. I'm sorry for the issue. Fighting bad actors sucks, but we can do better to communicate with good faith builders like yourself. Mind sending me a note with your account at jeff@twilio.com, and I'll escalate for you.

A request from a random HNer – could you also commit to observing what the user's interactions with your customer service have been so far; and improving each of those, instead of nebulously "escalating" (where people will unblock an account because the CEO mandated it from up on high)? Otherwise, you are contributing to a pattern where HN becomes de facto Tier 1 Customer Service, similar to how Twitter was a few yea…

I'm going to have to cop to this. I was desperate and needed a way to get my phone calls up and running. I have many employees that rely on me to feed their families. We employ a lot of refugees with large families and if I don't run my business right, they can't feed their families. This isn't a game.

I posted to HackerNews because I suspected my issue would be seen and taken seriously if I did that. I could tell the ticketing system people were overlooked and only looking at my issue in a very shallow way.

If this had not worked, I would have started using my Stack-overflow account then Reddit. If that didn't work, I found an address of a lady how works for Twilio nearby, I was going to go knock on her door and see if she could put me in touch with someone.

Luckily I was able to get the problem resolved without those additional steps.

I would like to point out that Twilio's ticketing system works well for complex problems that are not time-sensitive. I had an issue a few months back that I think was probably quite complicated involving bureaucracy and multiple carriers and it was resolved in a few days via their ticketing system which was very cool.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#132

Post by laurensr »

madars wrote: post #88
vorpalhex wrote: post #8

Earlier quoted context omitted.

I have set up a few twilio accounts like this where a business number blindly forwards to the business owner's personal cell, maybe some logic for business hours and holidays. If twilio wants us to start filtering spam messages for these cases, they need to give us the API/tooling. Or let us pre-register receiving numbers through an opt-in process. I understand Twilio not wanting to be an open relay but the reported…

Yeah this sounds highly problematic. Maybe in the meantime you can text links to your own portal instead. I.e. "New SMS received from +123... . Read it at: https://your-internal-infrastructure.com/sms/[GUID] " (maybe with a simple login so Twilio auto-fetch, if any, gets a benign page). That way there is no spammer-controlled message content (apart from the phone #) in the message you send. Or convert them to jpeg an…

Or base64 encode the orginal message :p

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#133

Post by YXNjaGVyZWdlbgo »

ChrisDutrow wrote: post #117
YXNjaGVyZWdlbgo wrote: post #87

Earlier quoted context omitted.

It's not even good business practice you are paying for something that is essentially free if implemented in every other way. This is not creative this abusing a system going against their ToS and blaming them for your own failure. I am suggesting you ingest the received messages and distribute it any other way like a lot of twilio customers probably do. This is merely a hack and a bad one at that.

Quoted post unavailable.

No post body was provided.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#134

Post by SkeuomorphicBee »

ChrisDutrow wrote: post #126
yodon wrote: post #121

Earlier quoted context omitted.

This sounds like a highly problematic solution. If twilio actually greenlights spam that starts with "Forwarded from XXX.XXX.XXXX:" as Greg suggests, you can be sure actual spammers reading this thread will catch on and start sending spam texts with a header intro like that, probably by EOD today.

I think one of the key contexts here is being forgotten: These are all internal messages. Someone cannot use our system to text random people. It's literally one person seeing them. We're a local service company. We're not SAAS or something like that. It's just people messaging us "Hey can you guys come Thursday?" This would be like if you signed up for a VOIP provider for your business phones and they suspended your…

With due respect, you are the one ignoring key context:

From the employee's carrier perspective those are external messages originating from you.

All that Verizon/T-Mobile/at&t see is spam coming from you, they don't know about the employer/employee relation. So when those carries complain to your carrier, your carrier has little options but to lock you.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#135

Post by ChrisDutrow »

jeffiel wrote: post #110

Hi Chris - CEO of Twilio here. I'm sorry for the issue. Fighting bad actors sucks, but we can do better to communicate with good faith builders like yourself. Mind sending me a note with your account at jeff@twilio.com, and I'll escalate for you.

Hey Jeff,

Thanks for taking the time to respond. The fact that you responded to this message at all resolves my initial concern, which had more to do with if I needed to change providers because of a cultural shift within your company. I understand that you are dealing with a very large and complex system that is changing quickly and will have problems, sometimes serious problems sometimes. Customer communication specifically is a very difficult and complex problem to solve at scale.

I actually spoke with one of the founders of Twilio when I first signed up. Evan maybe? He told me about how he studied cloud computing at MIT. This was a very long time ago.

Gregg was able to get the problem resolved within about 30 minutes once I reached out to him. He also provided me with a few solutions to prevent the problem in the future.

I understand the complicated problem that that led to this mistake and I think it is reasonable to make mistakes like this sometimes, especially if you're providers are threatening to suspend you.

The main problem that I would like you to solve is the lack of phone number. There needs to be a way for people to contact the company if there is an account administration emergency like this. Even chat would have been fine.

That being said, I did call sales and could not reach someone. If this is due to covid omicron and if normally I had called sales and would have been able to plead my case and gotten them to connect me with someone, I think that would have been fine and this truly is an edge case.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#136

Post by ChrisDutrow »

Turing_Machine wrote: post #96
jaywalk wrote: post #86

Earlier quoted context omitted.

Nope, that's not how Twilio works. Yes, someone else sent a spam message, but Twilio did not forward it to "their customer's list" whatever that means. Twilio forwarded it to their customer's application , which was the end of the line for Twilio. At that point, their customer's application sent out that spam message to whoever was configured to receive it. As far as Twilio is concerned, the incoming and outgoing mes…

That's a distinction without a difference. By their own policy, Twilio's upstream should ban them for "forwarding spam". I'm guessing they would not be happy if that policy were applied.

You are really good at explaining these things.

Very often people say things that I know are incorrect and actually sound quite stupid, but then I am unable to articulate why. I was very surprised at the number of incorrect negative responses from people to this post, who seemed to grab onto details and then use them to twist reality.

How did you learn to dissect these arguments and then clearly refute them?

Also, I have never heard "distinction without difference" before, but it is a common way that people twist reality. Did you study logical fallacies? Or read a good book on how to deal with them?

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#137

Post by ChrisDutrow »

howdydoo wrote: post #9
grouseway wrote: post #3

For an alternative, maybe relay the texts to a slack channel (that's easy enough to receive on a phone for your coworkers). Zapier can probably integrate twilio/slack quickly.

Then what do you do when Slack bans your account?

I'm going to guess that slack would not ban for this reason. It would not make sense at all.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#138

Post by Sohcahtoa82 »

YXNjaGVyZWdlbgo wrote: post #93
Sohcahtoa82 wrote: post #91

Earlier quoted context omitted.

What they're getting at is that Twilio clearly already has the capability of automatically detecting spam. Why not open that capability to an API so that somebody who is operating some sort of forwarding service to run spam detection before forwarding?

Because they are not in the business of filtering spam they are in the business of receiving and delivering messages. The spam filtering outbound is to protect their own core service. Running spam protection for your own service is a lot different to offering spam protection for customers.

Do you not see how spam protection for customers IS spam protection for your own service?

They already detect outgoing spam. Good customer service in this case would be to detect that a customer is attempting to send spam and blocking it and potentially notifying them about it.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#139

Post by ChrisDutrow »

willcipriano wrote: post #41
tobyjsullivan wrote: post #34

Earlier quoted context omitted.

There are two layers here. 1) You're absolutely right that the account ends up texting out a phishing link which any automated system would rightfully detect as phishing (regardless of whether the recipient has "consented" to receiving the message - it still contains a phishing link). But that's not the real issue, which is 2) Twilio's response to detecting the sending of a phishing link (possibly more than one) is t…

As a text message recipient, I can't say I'm mad about Twillo's choice here.

I should clarify that these messages are being relayed internally to me and like two other people. It would not be possible for someone to use out software to spam people. We are not a SAAS provider. We are a local service company.
Post reply on HN