Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

Post reply on HN
Print view View original

51–60 of 221 posts

Re: Twilio’s toll fraud problem

#51

Post by acover »

Terretta wrote: post #33

Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges . If a threshold of Twilio customers dispute charges, Twilio loses the ability to process credit cards at a lower risk rate, then with all but high risk processors, then may lose the ability to process them at all. If enough of their customers are getting burned, and enough dispute, Twilio would no longer…

That Twillio doesn't protect you is bad. However, would a court agree you don't owe them the money? This recommendation seems like abuse of disputing a charge and will just get you banned from Twillio.

Re: Twilio’s toll fraud problem

#52

Post by EGreg »

toomuchtodo wrote: post #44
tomesco wrote: post #43

Earlier quoted context omitted.

Couldn't Twilio also close and cease providing service to any accounts that initiate chargebacks?

They could, but customers could then file complaints with the FTC and their state’s attorney general for the fraud Twilio is enabling. I strongly encourage Twilio customers to pursue this route if Twilio is charging them for fraudulent charges.

Customers can do that anyway.

Re: Twilio’s toll fraud problem

#53

Post by EGreg »

randyburden wrote: post #48

We've been hit by this at work as well. We had to add CAPTCHA and a several other techniques to defend against this. How it works: 1. Attacker leases 1 or more premium rate numbers in an international country. - Attacker can lease a premium rate number for as little as $10/month - Typically, the attacker gets to keep 70% of the money generated by the premium rate number. 2. Attacker then finds companies with OTP (One…

With AI, you won't be able to tell humans and computers apart anymore.

Anyone with enough determination can execute a sybil attack on any service that doesn't require in-person verification.

Re: Twilio’s toll fraud problem

#54

Post by bee_rider »

bombcar wrote: post #41
johndhi wrote: post #29

Earlier quoted context omitted.

Confused, I don't see what's in common with all of the companies in your list. I work with Twilio a lot and kind of agree with your last sentence but what do you mean? Are these normal business practices?

They start out insanely great when riding high on VC cash, but over time they become the gorilla in the room and their service and support and quality begins to diminish until they're more annoying than they are helpful.

It is surprising that our VC based companies haven’t been hit with anti-dumping sanctions. I guess if there are enough extra steps…

Re: Twilio’s toll fraud problem

#55

Post by from »

rcme wrote: post #12

I'm surprised it's not possible for Twilio to detect premium rate numbers. How does Twilio negotiate the payment with the number holder?

These numbers are usually not premium in the 1-900 sense of the word. It's more like they are international numbers and there are various intermediaries who work with mobile/landline operators in a bunch of countries to set up these kind of numbers and split the revenue from incoming calls/texts if they can deliver lots of minutes to them. One way of doing so is by getting a bunch of 2fa texts sent.

Re: Twilio’s toll fraud problem

#56

Post by tobinfekkes »

bombcar wrote: post #41
johndhi wrote: post #29

Earlier quoted context omitted.

Confused, I don't see what's in common with all of the companies in your list. I work with Twilio a lot and kind of agree with your last sentence but what do you mean? Are these normal business practices?

They start out insanely great when riding high on VC cash, but over time they become the gorilla in the room and their service and support and quality begins to diminish until they're more annoying than they are helpful.

Couldn't have said it better myself.

There's a very obvious pattern on the spectrum of | Asset -> Liability |, and sadly, time proves they're much closer to a liability than an asset.

Over time, tech becomes a tax.

Re: Twilio’s toll fraud problem

#57

Post by Scoundreller »

bragr wrote: post #50
Terretta wrote: post #33

Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges . If a threshold of Twilio customers dispute charges, Twilio loses the ability to process credit cards at a lower risk rate, then with all but high risk processors, then may lose the ability to process them at all. If enough of their customers are getting burned, and enough dispute, Twilio would no longer…

>Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges. I'd check their TOS to see if they offer some kind of arbitration option. As noted in other threads, triggering that process can be a surprisingly effective way to make someone from the company actually engage with the issue. Disputing the charges is always a nuclear option. They may never do business wi…

Is there anything in the arbitration clauses forbidding them from cancelling your account if you invoke arbitration (regardless of whether you prevail or fail?).

Re: Twilio’s toll fraud problem

#58

Post by tobinfekkes »

mxuribe wrote: post #20
tobinfekkes wrote: post #8

I loved Twilio many years ago, but they've become the new Google/SendGrid/Shopify/Stripe/Uber/(soon to add CloudFlare). They retain the right to any/all the upside of any risk/scale, and you retain the obligation in any downside. No questions. It's despicable.

Same here! So, i wonder then, who would be a viable alternative to Twilio?

Unfortunately, I haven't found any. There are some hacky solutions that I've bookmarked over the years, but nothing reliable enough for a production service(s). At least that I've found.

Most "alternative" SMS services a simply a façade built on top of Twilio, with the markup to prove it.

Re: Twilio’s toll fraud problem

#59

Post by ridgered4 »

nebula8804 wrote: post #13

Isn't this something Elon Musk brought up a few weeks ago when Twitter SMS 2FA stopped working in some countries? (India? I think?). On a Twitter spaces he said they were losing millions to SMS fraud for years and found out that some Telecom companies were complicit so they just cut off all SMS traffic to those companies until they re-negotiated terms.

Last time I tried to sign up for Twitter it demanded I verify my account with text messages. Actually, virtually all services do this now when creating an account. The worst (Microsoft for example) let you sign up and use the account for a bit (possibly purchasing some items tied to the account) and then extort the phone number out of you later to maintain access.

It is sort of amusing that these companies hitched their wagon to the now scam laden telephone network to track users and ended up getting scammed themselves.

Re: Twilio’s toll fraud problem

#60

Post by Scoundreller »

bombcar wrote: post #38
techsupporter wrote: post #23

Earlier quoted context omitted.

> They know how much to bill the customer I don't mean to do Twilio's work of defending them, but in my experience it's possible they actually don't know how much to bill the customer. What they may know is the generalized per-minute or per-session rate they've agreed with another operator alongside a general "premium rate numbers will be settled at a later date" kind of clause. My employer got bit by this several ye…

This is the case, the telephone billing system is perhaps the most complicated pile of softwareshit you have ever seen in your LIFE - and some of it is insane. There have been people who got printed bills from their cell phone provider for every single kilobyte of data, each individually indexed and billed: https://en.wikipedia.org/wiki/300-page_iPhone_bill

My favourite was getting charged for an sms my iPhone sent which was a phone home to an Apple headquarters short code for iMessage. iOS hides these from the user. Most providers don’t charge for this, but some do.

Really sucks when you carefully load 10 EUR of credit to buy a 10 EUR prepaid plan for the month and see 0,05 deducted despite being incredibly careful to not do anything that would incur a charge before buying the plan.

Post reply on HN