Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

31–40 of 221 posts

Re: Twilio’s toll fraud problem

#31

The idea that you can contact a phone number without any idea how much it will cost in 2023 is crazy. At the least, there should be a list of phone numbers known to not result in surprise charges so you can block all others.

The idea that phone numbers still exist is kinda crazy. It's like paper checks... just let it die.

Re: Twilio’s toll fraud problem

#33
Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges.

If a threshold of Twilio customers dispute charges, Twilio loses the ability to process credit cards at a lower risk rate, then with all but high risk processors, then may lose the ability to process them at all.

If enough of their customers are getting burned, and enough dispute, Twilio would no longer be able to accept credit cards. They are terrified of that, so begging you not to dispute charges for their lack of fraud prevention.

You accepting anything less than full refund of all fraudulent use they're cascading back on you is a gift to them. You accepting less than a full refund, while not dinging them at all with a chargeback is also a gift to them. If they don't want to give you the full refund for misuse they should be preventing, dispute it, as is your right.

The correct course for Twilio is for Twilio to refund these charges no questions asked while fixing the problem.

Re: Twilio’s toll fraud problem

#36
post #2

https://nitter.kylrth.com/benjaminnetter/status/153085292888... If you want to read the tweet on how it works.

What's in it for the fraudster here?

They own the premium number that the victim is texting... and thus earning the charged money.

Re: Twilio’s toll fraud problem

#38
post #16

Earlier quoted context omitted.

Solving this is squarely Twilio's business! They know how much to bill the customer, so they must know how much it costs to send to a number.

> They know how much to bill the customer I don't mean to do Twilio's work of defending them, but in my experience it's possible they actually don't know how much to bill the customer. What they may know is the generalized per-minute or per-session rate they've agreed with another operator alongside a general "premium rate numbers will be settled at a later date" kind of clause. My employer got bit by this several ye…

This is the case, the telephone billing system is perhaps the most complicated pile of softwareshit you have ever seen in your LIFE - and some of it is insane.

There have been people who got printed bills from their cell phone provider for every single kilobyte of data, each individually indexed and billed: https://en.wikipedia.org/wiki/300-page_iPhone_bill

Re: Twilio’s toll fraud problem

#39
post #24

Earlier quoted context omitted.

> There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. They know how to charge you for these numbers so apparently they do have that data, no?

Depends what you mean by "premium rate." Every number costs money to call in Twilio. Some numbers cost more, in lots of these frauds numbers in ordinary ranges are used (Is a rural number in Chile that costs $0.20/minute to call premium rate/fraud? Because that's what it looks like a lot of the time. How about $0.05 a minute in Austria?). IRSF, the industry term for this kind of fraud causes billions in losses a year…

Block any number that costs more than 25th percentile would be a start and so on... I can come up with plenty of heuristics that would be better than nothing.

Re: Twilio’s toll fraud problem

#40

Earlier quoted context omitted.

I'm surprised/confused: Why is it hard to detect premium rate numbers, or at least set a flag to not allow sending to them? Like, I can't think of a time when twillo should ever be sending to a premium rate number; why is this even possible?

There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem. Edit: To be clear, this is a very well know…

Twilio works with phone companies across the globe; this is not something that would be that difficult for a company of their size to implement (even if it means one employee whose job it is to keep this up to date). Consider that the timezone database (a similar problem) is administered by one person (a volunteer no less)
Post reply on HN