Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

Post reply on HN
Print view View original

151–160 of 221 posts

Re: Twilio’s toll fraud problem

#151

Post by hedora »

Natsu wrote: post #118
mike_d wrote: post #107

Earlier quoted context omitted.

Which seems like a super easy fix for Twilio to implement. Don't allow SMS to premium rate numbers. If they can identify the premium numbers for billing, they should be able to identify them for blocking.

Down thread someone pointed out that their API allows you to set a max price: https://www.twilio.com/blog/2015/08/introducing-max-price.ht... Apparently a lot of people could really use that info.

Why is this not set to zero dollars be default?!?

I agree with other comments here. $0 is the minimum amount people should be willing to pay if they're not disputing charges or reporting fraud to the credit card networks / regulators.

Time is money, after all.

Re: Twilio’s toll fraud problem

#153

Post by hedora »

randyburden wrote: post #48

We've been hit by this at work as well. We had to add CAPTCHA and a several other techniques to defend against this. How it works: 1. Attacker leases 1 or more premium rate numbers in an international country. - Attacker can lease a premium rate number for as little as $10/month - Typically, the attacker gets to keep 70% of the money generated by the premium rate number. 2. Attacker then finds companies with OTP (One…

I don't understand why twilio cannot simply set a flag on their phone company account saying "under no circumstances will we pay for these shenanigans", and why the phone company billing stuff cannot simply block sms messages to such scam accounts.

In particular, email (smtp) to sms gateways exist. Why doesn't twilio just use one of those (and maybe pre-arrange a flat monthly payment to avoid being blocked for going over quota).

Re: Twilio’s toll fraud problem

#154

Post by Natsu »

hedora wrote: post #151
Natsu wrote: post #118

Earlier quoted context omitted.

Down thread someone pointed out that their API allows you to set a max price: https://www.twilio.com/blog/2015/08/introducing-max-price.ht... Apparently a lot of people could really use that info.

Why is this not set to zero dollars be default?!? I agree with other comments here. $0 is the minimum amount people should be willing to pay if they're not disputing charges or reporting fraud to the credit card networks / regulators. Time is money, after all.

No idea. I think there's a real problem with the whole design of premium numbers because I'm not sure how one is even supposed to know when payment is required or meaningfully accept it, though at least the API apparently allows this.

Re: Twilio’s toll fraud problem

#155

Post by quanticle »

Scoundreller wrote: post #57
bragr wrote: post #50

Earlier quoted context omitted.

>Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges. I'd check their TOS to see if they offer some kind of arbitration option. As noted in other threads, triggering that process can be a surprisingly effective way to make someone from the company actually engage with the issue. Disputing the charges is always a nuclear option. They may never do business wi…

Is there anything in the arbitration clauses forbidding them from cancelling your account if you invoke arbitration (regardless of whether you prevail or fail?).

If they did that, then there would be no incentive for customers to choose arbitration over filing a dispute with their credit card.

Re: Twilio’s toll fraud problem

#156

Post by Raed667 »

mcstempel wrote: post #148
mcstempel wrote: post #140

I find it particularly frustrating that they force you to upgrade to Verify to solve the problem unless you want to build out a lot of your own internal risk detection (which we ended up doing instead) With the rise of AI APIs, I expect we'll see similar attack vectors for apps that integrate APIs from OpenAI or Stability. There won't be a colluding telecomm, but the API output (a completed task) is relatively fungib…

Also, a tip for anyone that feels like the low hanging fruit prevention methods aren't working (e.g. CAPTCHA, rate limits, etc.) Consider installing a device fingerprinting system -- this has be the single most effective solution we've seen our customers integrate for more sophisticated bot problems: https://stytch.com/docs/fraud#device-fingerprinting . I'd recommend against the off-the-shelf solutions (e.g. open sou…

Had some good results with SEON (https://seon.io/) underneath they use fingerprint.js (https://fingerprint.com) to give you a confidence score.

Re: Twilio’s toll fraud problem

#157

Post by simfree »

username_my1 wrote: post #117
Teever wrote: post #72

Earlier quoted context omitted.

> Disputing the charges is always a nuclear option. They may never do business with you after that. This is something that I think needs to be regulated. I'm not saying that this should be the case for a company the size of Twilio, but I definitely think that a company the size of Apple/Google/Samsung should not be able to ruin your life because you had temerity to stand up to them and dispute a charge.

Also twilio … they’re the industry standard for enterprise communications

Twilio has a neat platform, but their standards are very low or nonexistent when you experience jitter, large audio buffers or routing issues.

Providing PCAPs and reproducing routing issues doesn't result in support addressing these issues. Many other IPES and CLECs will actually fix these issues when documented.

Re: Twilio’s toll fraud problem

#158

Post by PenguinCoder »

acover wrote: post #81
helsontaveras18 wrote: post #70

Earlier quoted context omitted.

And then you switch to another SMS provider, which may be costly from an engineering perspective, but clearly worth it if you’re getting slammed with botnets and Twilio doesn’t care. Absolutely, dispute the charge.

Which providers don't have this problem? Does AWS prevent you sending SMS to premium numbers?

Almost any provider will have these sorts of problems. In my experience though, SignalWire has been great for customer service and working with.

Re: Twilio’s toll fraud problem

#159

Post by matlin »

We had this exact thing happen to us. I think the most offensive part is that Twilio still makes money as their customers get scammed so are financially incentivized to keep letting it happen. And on top of that they disrespect their customers by forcing you to prepay for your usage but will still happily let some scammer run your balance into the deep negatives even if you turn off auto-refill.

Re: Twilio’s toll fraud problem

#160

Post by devman0 »

ricardo81 wrote: post #95
globalreset wrote: post #39

Earlier quoted context omitted.

Block any number that costs more than 25th percentile would be a start and so on... I can come up with plenty of heuristics that would be better than nothing.

Yes, or let the user define a max cost

They do: https://www.twilio.com/blog/2015/08/introducing-max-price.ht...
Post reply on HN