Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

Post reply on HN
Print view View original

81–90 of 221 posts

Re: Twilio’s toll fraud problem

#81

Post by acover »

helsontaveras18 wrote: post #70
acover wrote: post #51

Earlier quoted context omitted.

That Twillio doesn't protect you is bad. However, would a court agree you don't owe them the money? This recommendation seems like abuse of disputing a charge and will just get you banned from Twillio.

And then you switch to another SMS provider, which may be costly from an engineering perspective, but clearly worth it if you’re getting slammed with botnets and Twilio doesn’t care. Absolutely, dispute the charge.

Which providers don't have this problem? Does AWS prevent you sending SMS to premium numbers?

Re: Twilio’s toll fraud problem

#82

Post by jpeg_hero »

mxuribe wrote: post #20
tobinfekkes wrote: post #8

I loved Twilio many years ago, but they've become the new Google/SendGrid/Shopify/Stripe/Uber/(soon to add CloudFlare). They retain the right to any/all the upside of any risk/scale, and you retain the obligation in any downside. No questions. It's despicable.

Same here! So, i wonder then, who would be a viable alternative to Twilio?

i've used these guys: Thinq and they are awesome for sms / messaging apis

https://www.thinq.com/sms-mms-text-messaging/

Re: Twilio’s toll fraud problem

#83

Post by csunbird »

Scoundreller wrote: post #60
bombcar wrote: post #38

Earlier quoted context omitted.

This is the case, the telephone billing system is perhaps the most complicated pile of softwareshit you have ever seen in your LIFE - and some of it is insane. There have been people who got printed bills from their cell phone provider for every single kilobyte of data, each individually indexed and billed: https://en.wikipedia.org/wiki/300-page_iPhone_bill

My favourite was getting charged for an sms my iPhone sent which was a phone home to an Apple headquarters short code for iMessage. iOS hides these from the user. Most providers don’t charge for this, but some do. Really sucks when you carefully load 10 EUR of credit to buy a 10 EUR prepaid plan for the month and see 0,05 deducted despite being incredibly careful to not do anything that would incur a charge before bu…

Apple DOES say that, when you set up FaceTime and iMessage!

There is a pop up that says "Your carrier may charge for the messages used to activate iMessage and Facetime" You can choose to not activate and do it later.

Re: Twilio’s toll fraud problem

#84

Post by purpleblue »

rippercushions wrote: post #11
yjftsjthsd-h wrote: post #4

Earlier quoted context omitted.

I'm surprised/confused: Why is it hard to detect premium rate numbers, or at least set a flag to not allow sending to them? Like, I can't think of a time when twillo should ever be sending to a premium rate number; why is this even possible?

There are 200+ jurisdictions in the phone network and everybody has their own conventions on what a "premium" number is. For comparison, imagine if each domain in the world could set its own rates for much doing a DNS query would cost you, and governments regulated this only by designating a few second level domains as "premium". That's pretty much the scale of the problem. Edit: To be clear, this is a very well know…

This is NOT hard. Not at all.

Twilio knows which numbers will charge customers, THEY HAVE THE DATA. They can make a list of numbers that charge customers, and then have a flag that disallows SMSes to those numbers.

They also have relationships with phone providers in every market that they are in, and those providers can provide that same information and then allow a blacklist to those numbers or whatever format the premium numbers occur in.

It's not hard at all. It's a nice value-add feature and I'm sure if a competitor like MessageBird implemented something like this, it would be an easy differentiator if Twilio doesn't want to provide this.

Re: Twilio’s toll fraud problem

#85

Post by yashap »

We’ve had the same problems. We use Twilio for SMS based OTP login, lost lots of money to toll fraud, and spent lots of time putting up various mitigation strategies to reduce it. Now we only lose a bit of money to toll fraud, but if was lots of engineering effort and $$ down the drain.

My main suggestion would be to avoid any sort of flow, like SMS OTP login, that allows triggering SMS messages without being logged in. Just do a more traditional login, SMS OTP isn’t worth the headaches.

Haven’t tried Twilio Verify, didn’t exist when we were solving these problems ourselves. But like most fraud prevention, it’s probably far from perfect, better to just avoid fraud-prone workflows if you can.

Re: Twilio’s toll fraud problem

#86

Post by Terretta »

toomuchtodo wrote: post #44
tomesco wrote: post #43

Earlier quoted context omitted.

Couldn't Twilio also close and cease providing service to any accounts that initiate chargebacks?

They could, but customers could then file complaints with the FTC and their state’s attorney general for the fraud Twilio is enabling. I strongly encourage Twilio customers to pursue this route if Twilio is charging them for fraudulent charges.

Further, the customer has the right to dispute credit card charges thanks to the agreement between customer and card provider and between card provider and merchant.

Twilio will get in trouble with Visa/Mastercard if customers say Twilio is dropping them for disputes the card provider finds in the customers' favor.

Re: Twilio’s toll fraud problem

#87

Post by TeMPOraL »

ender341341 wrote: post #71
eitau_1 wrote: post #67

Earlier quoted context omitted.

> premium rate number costs 10 cents wut, the absolutely most ordinary (in the realm of single telecom) text costs me ~6.5 cents

Can I ask where? I'm in the US and any of the big carriers offer unlimited texting as a baseline, and we have pretty crappy carriers compared to a lot of the world.

Maybe on prepaid plans? Been a while since I've heard of SMS costing anything on subscription plan, outside of roaming charges. Mobile Internet effectively cannibalized that income stream for the phone companies.

Re: Twilio’s toll fraud problem

#88

Post by Terretta »

acover wrote: post #51
Terretta wrote: post #33

Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges . If a threshold of Twilio customers dispute charges, Twilio loses the ability to process credit cards at a lower risk rate, then with all but high risk processors, then may lose the ability to process them at all. If enough of their customers are getting burned, and enough dispute, Twilio would no longer…

That Twillio doesn't protect you is bad. However, would a court agree you don't owe them the money? This recommendation seems like abuse of disputing a charge and will just get you banned from Twillio.

The court doesn't have to agree, only the card provider does.

The customer has the right to dispute credit card charges thanks to the agreements between customer and card provider and between card provider and merchant.

Twilio will get in trouble with Visa/Mastercard if customers say Twilio is dropping them for disputes the card provider finds in the customers' favor.

This is why you always pay for sketchy merchants with a card, it's one of the few consumer powers you have.

Re: Twilio’s toll fraud problem

#89

Post by TeMPOraL »

globalreset wrote: post #39
from wrote: post #24

Earlier quoted context omitted.

Depends what you mean by "premium rate." Every number costs money to call in Twilio. Some numbers cost more, in lots of these frauds numbers in ordinary ranges are used (Is a rural number in Chile that costs $0.20/minute to call premium rate/fraud? Because that's what it looks like a lot of the time. How about $0.05 a minute in Austria?). IRSF, the industry term for this kind of fraud causes billions in losses a year…

Block any number that costs more than 25th percentile would be a start and so on... I can come up with plenty of heuristics that would be better than nothing.

Yeah, I mean, with the number of users they have world-wide, they probably have good per-country or even per-county distributions of call rates...

Re: Twilio’s toll fraud problem

#90

Post by dhritzkiv »

dima_vm wrote: post #22
Natsu wrote: post #6

Earlier quoted context omitted.

You'd think they'd have an option simply not to let you connect to those toll numbers at all.

They do: https://www.twilio.com/blog/2015/08/introducing-max-price.ht...

Thank you. I can't believe I missed this API parameter when I was looking to solve our toll fraud issue a few years ago.
Post reply on HN