Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

Post reply on HN
Print view View original

11–20 of 221 posts

Re: Twilio’s toll fraud problem

#11

Post by rippercushions »

yjftsjthsd-h wrote: post #4
woofcat wrote: post #2

https://nitter.kylrth.com/benjaminnetter/status/153085292888... If you want to read the tweet on how it works.

I'm surprised/confused: Why is it hard to detect premium rate numbers, or at least set a flag to not allow sending to them? Like, I can't think of a time when twillo should ever be sending to a premium rate number; why is this even possible?

There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is.

For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem.

Edit: To be clear, this is a very well known problem and Twilio should be doing much better at it. But it's by no means an easy problem, and all the other side needs is one (1) number to exploit.

Re: Twilio’s toll fraud problem

#13

Post by nebula8804 »

Isn't this something Elon Musk brought up a few weeks ago when Twitter SMS 2FA stopped working in some countries? (India? I think?). On a Twitter spaces he said they were losing millions to SMS fraud for years and found out that some Telecom companies were complicit so they just cut off all SMS traffic to those companies until they re-negotiated terms.

Re: Twilio’s toll fraud problem

#14

Post by globalreset »

rippercushions wrote: post #11
yjftsjthsd-h wrote: post #4

Earlier quoted context omitted.

I'm surprised/confused: Why is it hard to detect premium rate numbers, or at least set a flag to not allow sending to them? Like, I can't think of a time when twillo should ever be sending to a premium rate number; why is this even possible?

There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem. Edit: To be clear, this is a very well know…

> There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is.

They know how to charge you for these numbers so apparently they do have that data, no?

Re: Twilio’s toll fraud problem

#15

Post by trulyhnh »

Yep, I remember getting pinged by a coworker asking why is our Twilio bill so high all of sudden. It turns out to be Toll Fraud through 2FA messages. Malicious actors sign up new accounts and setup 2FA number and just keep requesting 2FA through SMS to profit.

Re: Twilio’s toll fraud problem

#16

Post by nfm »

rippercushions wrote: post #11
yjftsjthsd-h wrote: post #4

Earlier quoted context omitted.

I'm surprised/confused: Why is it hard to detect premium rate numbers, or at least set a flag to not allow sending to them? Like, I can't think of a time when twillo should ever be sending to a premium rate number; why is this even possible?

There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem. Edit: To be clear, this is a very well know…

Solving this is squarely Twilio's business!

They know how much to bill the customer, so they must know how much it costs to send to a number.

Re: Twilio’s toll fraud problem

#17

Post by toast0 »

lotsofpulp wrote: post #3

The idea that you can contact a phone number without any idea how much it will cost in 2023 is crazy. At the least, there should be a list of phone numbers known to not result in surprise charges so you can block all others.

When I was working in this space, all of my providers gave me a pricing feed which was essentially phone number prefix, price (and some text that my system didn't care about, I don't need a name, just a price, thanks). It looks like twilio doesn't offer that publicly for SMS, but you can see their voice price list by clicking "download voice prices (.csv)" on their voice pricing page [1]. The SMS page has a similar feed, but it only gives you price by carrier name, which isn't very helpful --- you'd need to pay to do a carrier lookup before you could use the price list; these lists don't feel complete either anyway, but it's an idea.

[1] https://www.twilio.com/voice/pricing/us

Re: Twilio’s toll fraud problem

#18

Post by toast0 »

bbbbb5 wrote: post #10
alberth wrote: post #5

When you want to grow revenue at all costs, reducing/preventing fraud isn't a priority. E.g. why don't they have KYC controls during account opening? Because it would reduce the # of people who open an account.

Why on earth should Twilio have KYC controls during account opening?

As a programmatic telephone company, they're a possible (but not really probable) base for fraudulent spam calls. With KYC, and the fact that Twilio requires you call from a number you control, fraudulent calls would be easy to trace back to a person who could be charged for the calls. Much better than status quo, where it's very difficult to get to the originating phone account, and if you could, it's probably not really connected to a person.

Re: Twilio’s toll fraud problem

#19

Post by from »

alberth wrote: post #5

When you want to grow revenue at all costs, reducing/preventing fraud isn't a priority. E.g. why don't they have KYC controls during account opening? Because it would reduce the # of people who open an account.

Twilio and their users are the victim here... Twilio having KYC would not solve the problem, they do not the own the numbers the expensive texts are being sent to. Twilio should just enable their anti fraud systems by default (by the way this is no panacea, like every other anti fraud this is a cat and mouse game, there is often no clear way of telling that a number is premium rate, and many carriers are in on it too and use normal mobile number ranges).

Re: Twilio’s toll fraud problem

#20

Post by mxuribe »

tobinfekkes wrote: post #8

I loved Twilio many years ago, but they've become the new Google/SendGrid/Shopify/Stripe/Uber/(soon to add CloudFlare). They retain the right to any/all the upside of any risk/scale, and you retain the obligation in any downside. No questions. It's despicable.

Same here! So, i wonder then, who would be a viable alternative to Twilio?
Post reply on HN