Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#151

Post by ChrisDutrow »

ghusbands wrote: post #7
fatnoah wrote: post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

While literally the case from what is described, it's clear that a consensual (by employment) message forwarding service happening to forward received scams/spams is quite different to actually scamming/spamming. I guess it's unlikely that one can make this consent clear to Twilio, though, and if the messages aren't distinguishable then they might still get seen and reported as spam by the employee, with all the bad…

It might be possible to register numbers with them, but they still could get in trouble with the actual carrier of the cell number so it might not even matter.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#153

Post by ChrisDutrow »

jlundberg wrote: post #47
ChrisDutrow wrote: post #13

Earlier quoted context omitted.

This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that original number. The business case of relaying inbound text messages to an employee's phone number should be a very common one and should not warrant an account suspension.

This is actually technically possible in the networks, at least here in Europe (generally). However, obviously allowing such sms forwarding have to be done with care.

Yes I think you are right. But I don't think Twilio allows it unless I somehow register the number and authenticate that I own.

I could be wrong, but I think they have a way for me to register my cell number so I could "spoof" messages sent from it. But I would first have to prove to them that I own the number.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#154

Post by throw20110401 »

ChrisDutrow wrote: post #79
YXNjaGVyZWdlbgo wrote: post #33

Earlier quoted context omitted.

The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…

I did mitigate the problem last time. I communicated with them and they told me it was fine. I'm very curious. Is this a communication mistake? Like do you think I'm some big company that forwards text messages to random people? Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so. Your question abo…

> Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so.

The bit that you are missing is that this sort of thing is between Twilio and Twilio's carrier partners (sometimes mediated by third-party aggregators), and has nothing to do with you or your particular use case. Carriers have very low tolerance for third parties like Twilio sending spam to their customers. If carriers get pissed off at Twilio, they'll stop delivering messages coming from Twilio (or will impose other restrictions, like low rate limits, or perhaps charge more, etc.). Good carrier relationships keep Twilio running; bad carrier relationships cause all sorts of problems for Twilio and Twilio's customers.

The carriers do not know or care that the spam/fraud message you tried to send to your employee was just you forwarding along a message that some other random person sent to the Twilio number. All they would care about is that a spam/fraud message came from Twilio's platform.

Having said that, I too am disappointed in the policy of auto-suspension, and in how long it took for you to get the problem resolved, and that phone support is expensive to come by.. I think the right approach is to catch these things at send time and just refuse to send them. Sure, if some very high percentage of traffic is all spam, maybe an auto-suspension might be warranted, but I assume (hope) that's not the case for your account.

(Disclosure: I work at Twilio, though not on the messaging platform. My words & opinion here are my own, and don't reflect Twilio's stance on anything. Throwaway for obvious reasons; Twilio doesn't allow the rank-and-file to speak publicly about this sort of thing.)

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#155

Post by jjav »

jbkiv wrote: post #24
jrockway wrote: post #12

My thought is that for any business-critical service, you need to have bought the service from person-to-person sales channels. Many boring meetings where they walk you through a slideshow of their service even though you already have it working. Many meetings worth of negotiating a price that's 10x the off-the-shelf price. All instead of, you know, making your product. It's just the cost of doing business -- $5/user…

Makes total sense. If you buy a subscription for few dollars/month, don't expect a human being to answer your call. Google/Twillio/Sendgrid, whatever the service, all the same ticketing system and no real answer. HN crowd looks down on sales reps. But a good sales rep will 1) understand your business 2) will look for ways to match your needs to solutions they offer 3) will be your point of contact when things go wron…

> If you buy a subscription for few dollars/month, don't expect a human being to answer your call.

For a "few" dollars a month, maybe not.

But here the OP said it was around $600/month, so that's a fairly substantial chunk of ongoing spend, just to have zero way to contact someone on the phone on a showstopper problem that needs fixing ASAP.

Contrast with more traditional businesses like PG&E or Comcast. Both hated companies for reasons, but even so they are heads and shoulders above these cloud provider companies (google/twilio/etc) in terms of customer support.

I spend way less than $600 with each (around $100 for my small office) and yet I can immediately reach a human on the phone if there's any problem with my electric or internet service.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#156

Post by jjav »

gregorymichael wrote: post #18

Hey Chris, Greg from Twilio here. I'm so sorry for the frustration, lack of communication, and high friction to get this resolved. Want to drop me an email at gb@twilio.com and we'll see if we can get it sorted out?

An offer to help is always appreciated.

But seriously, it can't take a thread on HN to get a way to get support for a paying customer. There needs to be an 800 number they can call which is staffed with humans empowered to fix problems.

While I have no connection to this thread, I am also using Twilio in production and finding out here that if we ever have a problem there will be nobody answering the phone makes me reconsider what we should be doing to keep our business uptime.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#157

Post by ChrisDutrow »

throw20110401 wrote: post #154
ChrisDutrow wrote: post #79

Earlier quoted context omitted.

I did mitigate the problem last time. I communicated with them and they told me it was fine. I'm very curious. Is this a communication mistake? Like do you think I'm some big company that forwards text messages to random people? Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so. Your question abo…

> Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so. The bit that you are missing is that this sort of thing is between Twilio and Twilio's carrier partners (sometimes mediated by third-party aggregators), and has nothing to do with you or your particular use case. Carriers have very low toleranc…

Yeah I think we're on the same page here. I mean its a complicated problem, they're under pressure to solve it. They were backed into a corner by the carriers and suspended my account. Shit happens.

They just need a phone number. I actually called sales hoping I could plead my case and get them to connect me with someone. But I couldn't get connected with sales. If this was due to omicron and sales would have helped me, then this is truly an edge case.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#158

Post by YXNjaGVyZWdlbgo »

mindslight wrote: post #102
YXNjaGVyZWdlbgo wrote: post #43

Earlier quoted context omitted.

It is simply against the ToS to send spam over twilios network. Objectively this is what OP is doing. You are allowed to receive spam maybe your core business even depends on getting spam numbers or analyzes the spam for phishing links itself. You can receive and ingest it in anything you want you just can't send it over twilio yourself. Sorry this is not a design flaw this is just a bad workflow.

> Objectively this [send spam] is what OP is doing No, no it is not. These are legitimate consentual messages, regardless of the content. Please stop applying mechanical interpretations of obtuse rules and pretending it's some profound wisdom. Twilio and the rest of Big Tech are already doing this enough, thank you. Ultimately I think this problem is the end game of companies finding ways to absolve themselves of any…

Not for the carrier twilio is sending out these message to.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#159

Post by YXNjaGVyZWdlbgo »

Turing_Machine wrote: post #94
YXNjaGVyZWdlbgo wrote: post #40

Earlier quoted context omitted.

You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

Umm... "curating the data" is exactly what they're doing when they ban the customer for forwarding spam that originated from their system.

twilio might not care but the carriers the messages get send to will.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#160

Post by jjav »

ChrisDutrow wrote: post #148
rubatuga wrote: post #81

Seems like it’s his fault. I’m currently using the twilio API. A simple Python script could be used to filter out any messages that weren’t sent from an employee. He essentially has an unauthenticated open relay, a one way ticket to get put on a spam blacklist in the SMTP world.

It's not an unauthenticated open relay. It's like if you had a restaurant and you wanted to use Twilio. You might forward text messages sent to the restaurant number hosted on Twilio to your personal cell phone number.

Exactly, it's just call forwarding but for messages instead of voice calls. Completely legitimate business use case.
Post reply on HN