Twilio managed to convince everyone that SMS based auth was a good idea but it's always been a bad idea. Drop twilio and go back to using passwords and use a different 2fa method.
Twilio’s toll fraud problem
21–30 of 221 posts
Re: Twilio’s toll fraud problem
#22The idea that you can contact a phone number without any idea how much it will cost in 2023 is crazy. At the least, there should be a list of phone numbers known to not result in surprise charges so you can block all others.
You'd think they'd have an option simply not to let you connect to those toll numbers at all.
Re: Twilio’s toll fraud problem
#23Earlier quoted context omitted.
There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem. Edit: To be clear, this is a very well know…
Solving this is squarely Twilio's business! They know how much to bill the customer, so they must know how much it costs to send to a number.
> They know how much to bill the customer
I don't mean to do Twilio's work of defending them, but in my experience it's possible they actually don't know how much to bill the customer. What they may know is the generalized per-minute or per-session rate they've agreed with another operator alongside a general "premium rate numbers will be settled at a later date" kind of clause.
My employer got bit by this several years ago, purely on calls within the +1 country code. Before this practice was largely banned, some small carriers were allowed to designate certain rate centers as higher cost. So our VoIP carrier would say that a call to a given area code was $0.003/minute but the calls would later settle out at $0.25/minute because of a 1,000s block of numbers being (unknowing to us our our carrier) as higher cost and being settlement billed back at the higher rate.
Twilio could agree to carry some or all of this risk for its customers as part of their value-add and fees. That way, Twilio has the incentive to make the proper changes for its customers and would have the experience of looking at all of the return billed rates for all of the calls or messages across its entire customer base to help prevent toll fraud.
Re: Twilio’s toll fraud problem
#24Earlier quoted context omitted.
There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem. Edit: To be clear, this is a very well know…
> There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. They know how to charge you for these numbers so apparently they do have that data, no?
Depends what you mean by "premium rate." Every number costs money to call in Twilio. Some numbers cost more, in lots of these frauds numbers in ordinary ranges are used (Is a rural number in Chile that costs $0.20/minute to call premium rate/fraud? Because that's what it looks like a lot of the time. How about $0.05 a minute in Austria?). IRSF, the industry term for this kind of fraud causes billions in losses a year and there is no easy answer but Twilio should probably have more infrastructure in place to reduce massive surprise bills.
Re: Twilio’s toll fraud problem
#25Earlier quoted context omitted.
Why on earth should Twilio have KYC controls during account opening?
As a programmatic telephone company, they're a possible (but not really probable) base for fraudulent spam calls. With KYC, and the fact that Twilio requires you call from a number you control, fraudulent calls would be easy to trace back to a person who could be charged for the calls. Much better than status quo, where it's very difficult to get to the originating phone account, and if you could, it's probably not r…
Why should Twilio do this when nobody else does?
Re: Twilio’s toll fraud problem
#26The idea that you can contact a phone number without any idea how much it will cost in 2023 is crazy. At the least, there should be a list of phone numbers known to not result in surprise charges so you can block all others.
You can download phone prefixes with prices from them, and also set max price for an SMS (won't work if they charge just a little amount and you send thousand requests of course).
Re: Twilio’s toll fraud problem
#27Twilio managed to convince everyone that SMS based auth was a good idea but it's always been a bad idea. Drop twilio and go back to using passwords and use a different 2fa method.
Most users forget/neglect keeping backup codes for proper 2fa, unfortunately.
Re: Twilio’s toll fraud problem
#28Yep, I remember getting pinged by a coworker asking why is our Twilio bill so high all of sudden. It turns out to be Toll Fraud through 2FA messages. Malicious actors sign up new accounts and setup 2FA number and just keep requesting 2FA through SMS to profit.
Insane
Re: Twilio’s toll fraud problem
#29I loved Twilio many years ago, but they've become the new Google/SendGrid/Shopify/Stripe/Uber/(soon to add CloudFlare). They retain the right to any/all the upside of any risk/scale, and you retain the obligation in any downside. No questions. It's despicable.
Confused, I don't see what's in common with all of the companies in your list.
I work with Twilio a lot and kind of agree with your last sentence but what do you mean? Are these normal business practices?
Re: Twilio’s toll fraud problem
#30Does this Fraud Guard they offer protect against this? https://www.twilio.com/docs/verify/preventing-toll-fraud/sms...