Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

Post reply on HN
Print view View original

161–170 of 221 posts

Re: Twilio’s toll fraud problem

#161

Post by DuskStar »

ceejayoz wrote: post #143
Teever wrote: post #72

Earlier quoted context omitted.

> Disputing the charges is always a nuclear option. They may never do business with you after that. This is something that I think needs to be regulated. I'm not saying that this should be the case for a company the size of Twilio, but I definitely think that a company the size of Apple/Google/Samsung should not be able to ruin your life because you had temerity to stand up to them and dispute a charge.

I’m particularly afraid of it on Amazon, where a $20 dispute could nix my 800+ book Kindle library.

I would strongly recommend cracking the DRM on those when you have the chance.

Re: Twilio’s toll fraud problem

#162

Post by AdrianEGraphene »

dima_vm wrote: post #22
Natsu wrote: post #6

Earlier quoted context omitted.

You'd think they'd have an option simply not to let you connect to those toll numbers at all.

They do: https://www.twilio.com/blog/2015/08/introducing-max-price.ht...

Wow, ok. I've been hit with this issues twice and both times, the Twilio reps failed to let me know about this. I had previously resorted to just turning off any counties. Looks like mu international app users might get functionality back.... if this feature is still live.

Re: Twilio’s toll fraud problem

#163

Post by charcircuit »

0x62 wrote: post #106
charcircuit wrote: post #103

Earlier quoted context omitted.

Why would the card providers be in the customer's favor. The customer paid for a text to be delivered to a phone number and Twilio did that and then charged the customer for it. If you pay someone to mow your lawn, then they mow your lawn and charge you. You can't just chargeback after the fact to get that service for free.

In your analogy it would be more like paying someone to mow your lawn because your neighbour got it done for $10, then being charged $100 because your house number is even. It might be in the terms and conditions, but it’s bad faith to not give any warnings or controls before the services are rendered.

Except in that metaphor every service on your property costs 10x the price and it's a well known fact.

Re: Twilio’s toll fraud problem

#164

Post by charcircuit »

CaveTech wrote: post #115
charcircuit wrote: post #102

Earlier quoted context omitted.

If you told Twilio to text a number and they text it, I don't see how Twilio is at fault. It would be valuable if they let you avoid texting premium numbers, but that's just a feature on top of the service they provide.

They should be better equipped to detect and prevent the abuse. It's an order of magnitude higher request volume for phone #s located in remote regions of the world. Twilio knows full-well where those numbers go, and can see them being abused simultaneously across many customers. I don't possess the same ability to know this... unless I use Twilio to run a reverse-lookup, which would of course still incur a cost.

Yes, it would be helpful if they helped fight abuse, but that is not necessary of them. Having the capability is a competitive advantage so it would be in their interest to invest in it.

Re: Twilio’s toll fraud problem

#165

Post by tgsovlerkhgsel »

quanticle wrote: post #155
Scoundreller wrote: post #57

Earlier quoted context omitted.

Is there anything in the arbitration clauses forbidding them from cancelling your account if you invoke arbitration (regardless of whether you prevail or fail?).

If they did that, then there would be no incentive for customers to choose arbitration over filing a dispute with their credit card.

Arbitration is likely even more expensive than a dispute.

Re: Twilio’s toll fraud problem

#166

Post by jalaziz »

We faced this at my last company and this is actually a super mild case. In our case, we were dealing with call toll fraud. We ended up with tens of thousands of dollars in charges in less than 24 hours.

In our case, Twilio reached out to us to tell us they were detecting toll fraud. Before that, we actually had no idea what toll fraud was.

We quickly tried to address it with distributed rate limiting and that worked, for all of a couple of hours. The fraudsters quickly figured out the rate limit and worked around it by spacing out the calls and using more IPs.

Eventually, we had to disable a set of countries known for toll fraud and change our product to not connect calls in a variety of scenarios.

Re: Twilio’s toll fraud problem

#167

Post by a2tech »

rsync wrote: post #147
tobinfekkes wrote: post #8

I loved Twilio many years ago, but they've become the new Google/SendGrid/Shopify/Stripe/Uber/(soon to add CloudFlare). They retain the right to any/all the upside of any risk/scale, and you retain the obligation in any downside. No questions. It's despicable.

"I loved Twilio many years ago ..." I did as well. In fact, I built my own little personal telco around their services and API. It is all slowly falling apart, however, as their failure to build out their infrastructure offerings (as opposed to their "customer engagement" offerings) and the regulatory SNAFUs[1][2] that are emerging as a result of their behavior erode all of my use-cases ... All I wanted was more, and…

Their support for registering 800 numbers and verifying your identity is absolute 100% trash. I've filled out their verify form many times, every time to be prompted to do it all over again months later. Over and over again.

I was a HUGE Twilio booster back in the day. I encouraged its use heavily in my very large org because it was so much better than our entrenched phone provider. I was (maybe still am) featured on their website. But things have just gotten more..business-y, less developer focused, just..generally worse.

I don't know what to do with these guys anymore. I understand they're trying to grapple with the mess of regulations that got dumped on them, but their messaging and support around all this is BAD. There's no answers, just walls of canned text.

Re: Twilio’s toll fraud problem

#168

Post by richbell »

dahfizz wrote: post #120

This is the first I'm hearing of this, so I might be missing some information, bit I don't understand how this is Twilio's fault or responsibility. Your service got hit with a ddos-style attack that translated into you using twilio to send lots of texts. This cost you a lot of money. I don't see how this is categorically different than your kid "accidentally" buying movies on Amazon prime or something like that. No w…

> I don't see how this is categorically different than your kid "accidentally" buying movies on Amazon prime or something like that. No way a credit card company would accept a chargeback in that scenario.

The issue isn't the scale or volume, per se, it's that a bad actor has set up premium numbers (that cost $$$ to message) and is systematically wracking up fraudulent charges via websites sending 2FA codes. Twilio is seemingly aware of the fraud campaign targeting its users, but is not doing a great job protecting them and forcing them to bear the costs.

A better analogy, I think, would be a crime ring skimming credit cards at a gas station and wracking up charges that should be obvious fraud (different country, large amounts, etc.); and when a victim contacts their CC company they go "oh yeah that Shell station is notorious for fraud we've had lots of complaints recently" but refuse to chargeback.

Re: Twilio’s toll fraud problem

#169

Post by cakeface »

mabbo wrote: post #142
randyburden wrote: post #48

We've been hit by this at work as well. We had to add CAPTCHA and a several other techniques to defend against this. How it works: 1. Attacker leases 1 or more premium rate numbers in an international country. - Attacker can lease a premium rate number for as little as $10/month - Typically, the attacker gets to keep 70% of the money generated by the premium rate number. 2. Attacker then finds companies with OTP (One…

It isn't just as simple as 'premium rate numbers'. Some of the criminals behind these attacks will have access to the phone network. They'll pick an expensive route, like a range of phone numbers in Georgia (the country) from the USA, and offer a cheaper route to it. The system will start using their route for those calls. They'll accept all calls to that route, get paid, and never actually connect any calls. That gi…

How is this a workable system!? Why would anyone pay them. This seems like fraud on the part of the phone networks for billing for service that was never provided or should have been provided cheaper.

Re: Twilio’s toll fraud problem

#170

Post by saghm »

Terretta wrote: post #33

Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges . If a threshold of Twilio customers dispute charges, Twilio loses the ability to process credit cards at a lower risk rate, then with all but high risk processors, then may lose the ability to process them at all. If enough of their customers are getting burned, and enough dispute, Twilio would no longer…

There was an online service subscription I had several years back (not Twilio, but something somewhat similar) that I stopped needing. I forget if there either wasn't any way to this on their website or if it was just broken, but after repeatedly trying and failing, I ended up just disputing the charge the next time the monthly payment came up, and my bank stopped the transactions from that point on, so I forgot about it. A while later (probably around 6-12 months), I got an email from that company asking me to go back and tell my bank that the transactions were fine. Given that it had been so long and I only disputed the charge due to their website not giving me the ability to cancel through them, I didn't think it was worth trying to talk to someone at the bank to figure out how that would even work. It left an impression on me because it was the first time that I felt like I actually had any power in my relationship with a company as a customer rather than just having to hope that the company would chose to do right by me with nothing forcing them to.
Post reply on HN