Ask HN: Twilio suspended account because someone sent us a fraud text

What was the nature of the problem you had with them?

Mostly I can forget they exist and do other things with my business. But my use case is very vanilla: no outbound automated marketing, its used by only a few people at my specific company, we're not even a tech company -just blue collar stuff.

This year has been different though. I had to verify that I had a real business so that my number didn't get blocked on certain carriers, submitting the paperwork in the right way turned out to be kind of difficult, however I don't think this was something they had control over if I understand the situation correctly. One of the carriers blocked us anyway (They were blocking text messages with links to job info that I was sending to my employees). I used the ticketing system to get that problem fixed and they resolved it in a few days - I was under the impression it was kind of a complex problem too.

They also help us port numbers in from cell phones sometimes. And again the ticketing system is slow but they always get the problems resolved. None of these things being time sensitive, we were perfectly happy.

This type of thing is a difficult business problem for small and mid size businesses to solve. In this particular situation, I had a series of actions I was going to take to put out this particular fire. Normally I wouldn't do something like this, but my back was to the wall: * Call their sales number so I could plead my case to a real person within the company and have them put me in contact with someone * If that person refused - Call again and try with another sales person (This approach did not work because no one was answering the phone for sales, perhaps due to covid omicron?) * Post on HackerNews to see if I could get the attention of one of the brand ambassadors. (This worked, so I did not have to move on to the next steps) * Post on StackOverflow to see if I could get the attention of one of the brand ambassadors * Post on Reddit to see if I could get the attention of one of the brand ambassadors * Use LinkedIn to track down people who worked at Twilio. Use a paid service to get their phone numbers and addresses from their names. Call some of the people. * If no one answered the phone, go by the houses of Twilio employees who lived in my area

Long term, I wasn't sure what I would do because getting all the code switched to another provider would have been a huge hassle and it would have seriously gotten in the way of some of my other business development efforts. So I'm glad that Greg and Jeff reached out and reassured me that they don't intend to run their business this way.

A more difficult problem is Google and Facebook. I have had valuable pages stolen from me on both platforms (ex-employee) And neither company would engage with me. We're talking maybe $100,000 in lost property because of the amount of business the pages would bring in. Someone mentioned in another post on here that people are actually able to use HackerNews to get Google's attention. If I had known this I would have tried that. I knew Twilio might respond because they very often would help me when I posted technical questions on Stackoverflow in the past. I didn't think google and facebook cared as much about their brand because they have a monopoly.

You can rig this up yourself with Tasker and Pushover. There is an plug in for Tasker that enables using REST API calls and with variable names in the call so you can capture the text of an SMS. I used to do this for an old hotline phone.

You definitely did the right thing to get an urgent response. It's a shame you had to, but in your position I would do the same. Glad you've got it sorted, and it seems like you have some great suggestions in the thread to avoid this in future and have some contacts to help you out.

In my case, we sent over a ticket to port a number between accounts, and they ended up deleting our entire account, numbers, and all recordings and logs. They admitted it they made a mistake and processed the wrong ticket, but also flat out told us they couldn't recover anything. We were instructed to make a new account and they gave us our numbers back, but all our audio recordings, call logs, sms history etc was gone, all our SIDs, number ID's etc were different.

We have all screwed up, but we try to put things right. With Twilio it seems if they screw up, it's easier to leave you unhappy than do anything to fix it, unless you post on HN it seems.

Plivo is cheaper for phone numbers, free incoming SMS, and cheaper to send SMS.

Um, the twilio customer can be the spammer. They can send messages to anyone they want to target. Twilio IS running what is effectively an open rely.

To the degree twilio's business model depends on allowing its customers to send to whomever they want (which I assert it does), they CAN NOT let those customers send spam - full stop - end of discussion. If you don't understand why this is critical to twilio - I don't know what to say. MOST users do not want SMS spam.

Seriously, if you need to send SMS spam, use one of the "bulletproof" SMS spam players.

Even if we say customer is not a spammer, they are sending mail out to a wide variety of third party networks. In email land a closed SMTP server only forwards messages to an internal network or server under that admins control. As soon as you start blasting spam out to third party systems you are not a closed relay. That's literally how the verizon and other carrier systems will see this source of SMS spam and phishing.

The point about the reputation of IP or carrier / telephony origintion numbers / space remains. The use case here is prohibited by twilio's terms of service. Maybe just comply with those or find another provider.

Holy. Shit.

That would have been a freaking disaster if that happened to us, especially having to re-tool the application for new SIDs. I'm a little surprised that there is not a cooling off period after an account deletion as opposed to deleting everything immediately.

At least you got the numbers back.