Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#161

Post by ChrisDutrow »

_hyn3 wrote: post #69
ChrisDutrow wrote: post #22

Earlier quoted context omitted.

Ok I just e-mailed you, thanks so much

When a company has gotten so automated that the only way to get a solution is to beg and plead for help about it on social media, it's too automated.

I agree.

Although this particular thing may have happened because they got backed into a corner by the carriers. They might have been forced to scramble and suspend a bunch of accounts in order to protect themselves from being suspended. It's possible this might not have been a gambit to save money, but something they were almost forced to do without time to properly prepare. I'm just speculating, guessing.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#162

Post by onphonenow »

Xylakant wrote: post #149
ihumanable wrote: post #108

Earlier quoted context omitted.

I worked at Twilio for 6 years, the carriers would never allow the thing you are asking for. Twilio outbounds the SMS message over the carrier network. Part of that relationship is that Twilio has to prevent spam from entering the carrier network, or the carriers will ban the interconnect. Here's the full workflow of this situation. The inbound leg looks like this. [Spammer] -SMS-> [Carrier] -SMS-> [Twilio] -HTTP-> […

But twilio happily accepts spam - at least according to the OP. The message flow according to the post is Spammer -> SMS -> Twilio -> Forward by Customer -> SMS -> Customers own number. So the correct place to check would be on the incoming leg.

Twilio's absolute responsibility is to protect carriers from getting SMS spam outbound. Twilio has no such contractual requirements from its own customers. Could they offer an addon service for this on the inbound side? Sure. But if you are using their service to send spam and phishing links outbund, they MUST filter that or risk their entire operation.

Spam detection is not perfect. Users may want to process their own messages unmolested inbound.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#163

Post by ChrisDutrow »

quadrifoliate wrote: post #146
ChrisDutrow wrote: post #131

Earlier quoted context omitted.

I'm going to have to cop to this. I was desperate and needed a way to get my phone calls up and running. I have many employees that rely on me to feed their families. We employ a lot of refugees with large families and if I don't run my business right, they can't feed their families. This isn't a game. I posted to HackerNews because I suspected my issue would be seen and taken seriously if I did that. I could tell th…

I totally understand your point of view, and you are not at fault at all. Anyone with a small business who's faced with the faceless, understaffed customer service at modern web companies would have done the same thing. I hope your issue gets resolved quickly. IMO now that Twilio is a public company, they should be investing in better customer service. I am simply encouraging them to solve the actual problem in addit…

Oh no, I didn't take it that way. I just thought what you said was very interesting and wanted to provide more information and confirm that you were correct.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#164

Post by secabeen »

ChrisDutrow wrote: post #122
madars wrote: post #88

Earlier quoted context omitted.

Yeah this sounds highly problematic. Maybe in the meantime you can text links to your own portal instead. I.e. "New SMS received from +123... . Read it at: https://your-internal-infrastructure.com/sms/[GUID] " (maybe with a simple login so Twilio auto-fetch, if any, gets a benign page). That way there is no spammer-controlled message content (apart from the phone #) in the message you send. Or convert them to jpeg an…

Yes, these are very good ideas. Didn't even think of the JPEG one, very cool!

Yeah, we pass all of our twilio messages to our staff via a special Slack channel.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#165

Post by ChrisDutrow »

laurensr wrote: post #132
madars wrote: post #88

Earlier quoted context omitted.

Yeah this sounds highly problematic. Maybe in the meantime you can text links to your own portal instead. I.e. "New SMS received from +123... . Read it at: https://your-internal-infrastructure.com/sms/[GUID] " (maybe with a simple login so Twilio auto-fetch, if any, gets a benign page). That way there is no spammer-controlled message content (apart from the phone #) in the message you send. Or convert them to jpeg an…

Or base64 encode the orginal message :p

It needs to be human readable, so maybe pig latin instead

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#166

Post by onphonenow »

desmosxxx wrote: post #107
onphonenow wrote: post #45

Earlier quoted context omitted.

False. The customer may want to handle / filter the spam. The customer may be do a study of spam. The customer may be offering their customers a spam blocking service. Fine to provide an option to filter it perhaps, requiring twilio to block what it THINKS is spam is a recipe for disaster, spam filters are no where near perfect.

provide an option? send spam to some other bucket that the customer can view? label it so customer can filter it? warn them / block outbound spam (if it's not high qps I dont see a reason for the zero tolerance here, some kind of restricted mode is more reasonable). Communicate with the customer, especially when they contact you.. So many other options here

It's really clear that folks don't

a) understand the market twilio is trying to serve

b) been in this market.

This guy probably is not checking is error codes. Twilio will always give you 30007 in these cases.

https://support.twilio.com/hc/en-us/articles/360008704834-Er...

Almost certainly this guy failed to follow their messaging guidelines. If you send (or forward) spam that includes links to third party websites or URL shorteners THEY TELL YOU that may trigger spam / blocking behavior.

And yes, this needs to be a zero tolerance game - with spammers the reasonable limits turn into 100 accounts being setup by folks in india for someone for 20 cents an account.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#167

Post by onphonenow »

onphonenow wrote: post #45
Turing_Machine wrote: post #32

Earlier quoted context omitted.

If Twilio can detect that it's spam, surely the correct procedure would be to block it when it first comes into Twilio's system from outside, not blindly forwarding it to a customer's list and then blaming the customer for it! Sorry, this is just bad design. Re: > The customer may want to handle / filter the spam. Then provide the customer with a "yes, send me all the spam" option. Which do you suppose is the common…

False. The customer may want to handle / filter the spam. The customer may be do a study of spam. The customer may be offering their customers a spam blocking service. Fine to provide an option to filter it perhaps, requiring twilio to block what it THINKS is spam is a recipe for disaster, spam filters are no where near perfect.

parent edited their comment.

At least in use cases I was dealing with - we wanted zero filtering of inbound SMS because it was used as a control interface.

Spam didn't matter to us. Spammers had no idea how to format their messages etc. We also whitelisted inbound numbers.

The Twilio use case is not primarily for "mailing lists" and third party sms forwarding stuff.

And for a while SMS worked very well in certain IoT's contexts (SMS used to basically have its own channel that had surprisingly good deliverability for some reason).

Internationally in particular voice and data used to be potentially wildly expensive.

For sat backhaul, you could get 10 to 25 cents a message. A voice minute would be like $5 - $10. So this is a 100x difference potentially. Even data minutes were like $1-5/minute way back. The connection setup and teardown times were lower with SMS then doing a voice channel call etc. Pricing looks a lot better now, but still, messages are cheap (or free).

https://www.satphonestore.com/airtime/iridium-airtime.html

How does twilio even know that you will only forward messages they have scanned for spam? It seems like they MUST put the spam filter on the outbound leg.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#168

Post by mindslight »

YXNjaGVyZWdlbgo wrote: post #158
mindslight wrote: post #102

Earlier quoted context omitted.

> Objectively this [send spam] is what OP is doing No, no it is not. These are legitimate consentual messages, regardless of the content. Please stop applying mechanical interpretations of obtuse rules and pretending it's some profound wisdom. Twilio and the rest of Big Tech are already doing this enough, thank you. Ultimately I think this problem is the end game of companies finding ways to absolve themselves of any…

Not for the carrier twilio is sending out these message to.

No these messages are not spam there either, because they are not spam period.

What you might mean is that the carrier's draconian probabilistic anti-spam system incorrectly categorizes them as spam. And that this causes a practical problem for Twilio, which lacks any recourse against said carrier's incorrect classification. In other words, a similar problem to what OP is complaining about, one hop away.

You're doing nobody any favors by elevating technical details out of their narrow context and stating them as an unassailable description of high level behavior.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#169

Post by notreallyserio »

desmosxxx wrote: post #107
onphonenow wrote: post #45

Earlier quoted context omitted.

False. The customer may want to handle / filter the spam. The customer may be do a study of spam. The customer may be offering their customers a spam blocking service. Fine to provide an option to filter it perhaps, requiring twilio to block what it THINKS is spam is a recipe for disaster, spam filters are no where near perfect.

provide an option? send spam to some other bucket that the customer can view? label it so customer can filter it? warn them / block outbound spam (if it's not high qps I dont see a reason for the zero tolerance here, some kind of restricted mode is more reasonable). Communicate with the customer, especially when they contact you.. So many other options here

There's a whole contingent of engineers that are afraid of giving options to customers, and another that's annoyed at not having options. It's weirdly divisive and we're seeing that play out here.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#170

Post by ChrisDutrow »

secabeen wrote: post #164
ChrisDutrow wrote: post #122

Earlier quoted context omitted.

Yes, these are very good ideas. Didn't even think of the JPEG one, very cool!

Yeah, we pass all of our twilio messages to our staff via a special Slack channel.

Which pricing tier do you use? I've been thinking of starting with the for a while. Now we use a hodgepodge of Skype and WhatsApp
Post reply on HN