Twilio’s toll fraud problem • Hacker News Board

Re: Twilio’s toll fraud problem

#61

Post by rippercushions » Thu, Jan 05, 2023, 9:00 PM UTC

techsupporter wrote: post #23

nfm wrote: post #16

Earlier quoted context omitted.

Solving this is squarely Twilio's business! They know how much to bill the customer, so they must know how much it costs to send to a number.

> They know how much to bill the customer I don't mean to do Twilio's work of defending them, but in my experience it's possible they actually don't know how much to bill the customer. What they may know is the generalized per-minute or per-session rate they've agreed with another operator alongside a general "premium rate numbers will be settled at a later date" kind of clause. My employer got bit by this several ye…

Fun fact: +1 is not a country, but all of North America. For a long time it was entirely possible to dial a perfectly ordinary looking +1 258 xxxxxxx number and get charged up the wazoo because (258) is Antigua and Barbuda, not New Jersey.

Re: Twilio’s toll fraud problem

#62

Post by techsupporter » Thu, Jan 05, 2023, 9:01 PM UTC

fencepost wrote: post #42

techsupporter wrote: post #23

Earlier quoted context omitted.

> They know how much to bill the customer I don't mean to do Twilio's work of defending them, but in my experience it's possible they actually don't know how much to bill the customer. What they may know is the generalized per-minute or per-session rate they've agreed with another operator alongside a general "premium rate numbers will be settled at a later date" kind of clause. My employer got bit by this several ye…

Is it banned? Isn't this part of how FreeConferenceCall works with IIRC dial in numbers on a little LEC somewhere in Iowa?

Yes, the rule became effective in 2019: https://www.fcc.gov/document/fcc-adopts-reforms-further-redu...

(FreeConferenceCall and similar companies lobbied heavily against this rule, but AT&T and Verizon were able to lobby it through.)

Re: Twilio’s toll fraud problem

#63

Post by toast0 » Thu, Jan 05, 2023, 9:02 PM UTC

yjftsjthsd-h wrote: post #4

woofcat wrote: post #2

https://nitter.kylrth.com/benjaminnetter/status/153085292888... If you want to read the tweet on how it works.

I'm surprised/confused: Why is it hard to detect premium rate numbers, or at least set a flag to not allow sending to them? Like, I can't think of a time when twillo should ever be sending to a premium rate number; why is this even possible?

Twilio should help their customers with this (and it looks like they do have something, but maybe not enough)... but it's also something you can do a first pass through libphonenumber metadata[1], which was pretty reasonable at my last job.

[1] https://github.com/google/libphonenumber/tree/master/metadat...

Re: Twilio’s toll fraud problem

#64

Post by Scoundreller » Thu, Jan 05, 2023, 9:02 PM UTC

rib3ye wrote: post #37

woofcat wrote: post #36

Earlier quoted context omitted.

They own the premium number that the victim is texting... and thus earning the charged money.

Ah, it's like a 900 number, but for sms.

Has been going on against voip companies since the beginning.

Here’s a story from 2005:

https://www.forbes.com/forbes/2005/0919/058.html?sh=5531184c...

Re: Twilio’s toll fraud problem

#65

Post by rippercushions » Thu, Jan 05, 2023, 9:02 PM UTC

globalreset wrote: post #14

rippercushions wrote: post #11

Earlier quoted context omitted.

There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem. Edit: To be clear, this is a very well know…

> There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. They know how to charge you for these numbers so apparently they do have that data, no?

Telco billing is postpaid, so they actually won't find out for at least a month.

Re: Twilio’s toll fraud problem

#66

Post by hartator » Thu, Jan 05, 2023, 9:03 PM UTC

> They added a toggle for “fraud guard”

Where do you find this? I've spent 10 minutes on our Twilio account and couldn't find the toggle.

Re: Twilio’s toll fraud problem

#67

Post by eitau_1 » Thu, Jan 05, 2023, 9:04 PM UTC

randyburden wrote: post #48

We've been hit by this at work as well. We had to add CAPTCHA and a several other techniques to defend against this. How it works: 1. Attacker leases 1 or more premium rate numbers in an international country. - Attacker can lease a premium rate number for as little as $10/month - Typically, the attacker gets to keep 70% of the money generated by the premium rate number. 2. Attacker then finds companies with OTP (One…

> premium rate number costs 10 cents

wut, the absolutely most ordinary (in the realm of single telecom) text costs me ~6.5 cents

Re: Twilio’s toll fraud problem

#68

Post by colinclerk » Thu, Jan 05, 2023, 9:05 PM UTC

If anyone's facing this in their auth flows, we're happy to help at https://clerk.dev

We're in the same cat-and-mouse game with the attackers as everyone else, but since we're an auth company, we have full-time folks monitoring for issues and resolving when they come up.

It's worth mentioning that Twilio is in an understandably tough position here. They only receive API requests from your server, and real requests look the same as attack requests except for the phone number.

Clerk is in a better position to help because our API accepts traffic directly from the attacker (e.g. POST /verify-phone-number). We know their IP, user agent, whether they're connecting from AWS, etc, etc. We very much rely on this data to help stop them.

Re: Twilio’s toll fraud problem

#69

Post by andrewstuart » Thu, Jan 05, 2023, 9:06 PM UTC

When I recently wrote Twilio code the first thing I did was add in as much stuff as I could to prevent this sort of thing happening. I think I put in captcha and also IP address throttling and request counting.

At the time I wondered if I was overengineering or gold plating but apparently not.

I do seem to recall that Twilio writes about this issue quite alot and includes strategies in its best practices for avoiding the issue.

Re: Twilio’s toll fraud problem

#70

Post by helsontaveras18 » Thu, Jan 05, 2023, 9:07 PM UTC

acover wrote: post #51

Terretta wrote: post #33

Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges . If a threshold of Twilio customers dispute charges, Twilio loses the ability to process credit cards at a lower risk rate, then with all but high risk processors, then may lose the ability to process them at all. If enough of their customers are getting burned, and enough dispute, Twilio would no longer…

That Twillio doesn't protect you is bad. However, would a court agree you don't owe them the money? This recommendation seems like abuse of disputing a charge and will just get you banned from Twillio.

And then you switch to another SMS provider, which may be costly from an engineering perspective, but clearly worth it if you’re getting slammed with botnets and Twilio doesn’t care.

Absolutely, dispute the charge.