Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

Post reply on HN
Print view View original

181–190 of 221 posts

Re: Twilio’s toll fraud problem

#181

Post by alwayslikethis »

ceejayoz wrote: post #143
Teever wrote: post #72

Earlier quoted context omitted.

> Disputing the charges is always a nuclear option. They may never do business with you after that. This is something that I think needs to be regulated. I'm not saying that this should be the case for a company the size of Twilio, but I definitely think that a company the size of Apple/Google/Samsung should not be able to ruin your life because you had temerity to stand up to them and dispute a charge.

I’m particularly afraid of it on Amazon, where a $20 dispute could nix my 800+ book Kindle library.

Shouldn't have "bought" them in the first place. Buy physical books, or DRM-free books on sites like gumroad, or just pirate. Don't give in to the rent seeking business of pretending to sell you what you can't own. If you like your Kindle device, you can use KOReader to read epubs and reduce dependence on Amazon. If I sue the bookstore, they can't just take all the books away, but if you dispute a charge with Amazon, they'll do it because the ToS says they can. At the very least, try downloading and de-DRMing all the books you received from them: https://github.com/noDRM/DeDRM_tools

Re: Twilio’s toll fraud problem

#182

Post by from »

jjjjjjjjjjjjjjj wrote: post #104

I spent a lot of time playing cat and mouse with this type of toll fraud in 2022. 1. Rate limited SMS by number/ip: bypassed by large number of proxies/vpn. 2. Added captcha: bypassed by attacker manually signing up thousands of accounts (mechanical turks?) over months and then iterating over them for login OTP. 3. Identifying what carriers/operators are involved and blocking them asap (usually obscure ones). 4. Care…

Good advice. By the way, the reason captcha didn't stop it is because Recaptcha is $2 per 1000 solves on 2captcha.com (or any other solving service), at $0.02/SMS this only lowers their profitability by 10%.

Re: Twilio’s toll fraud problem

#183

Post by farhadhf »

And to top it off, disabling auto recharge doesn't prevent Twilio from charging your account. They won't charge your card but they won't stop processing requests when your balance reaches 0. We were just hit with toll fraud and even though auto recharge was disabled, they continued processing requests until our balance reached NEGATIVE 4,000 USD and then suspended the account. We received to emails in total:

1. Your balance is running low at -65 USD

2. (30 seconds later) your account is suspended, I checked the account an hour later when I saw this email and the balance was -4,000 USD

I asked support why they continued charging our account even with auto recharge disabled, but they just ignore the question.

Support says it's our fault, asks us not to dispute the charge (although there has been no charge yet as we disabled auto recharge), and said it will take 10 days for finance to issue a partial refund (that was 24 days ago).

Re: Twilio’s toll fraud problem

#185

Post by lmz »

Natsu wrote: post #118
mike_d wrote: post #107

Earlier quoted context omitted.

Which seems like a super easy fix for Twilio to implement. Don't allow SMS to premium rate numbers. If they can identify the premium numbers for billing, they should be able to identify them for blocking.

Down thread someone pointed out that their API allows you to set a max price: https://www.twilio.com/blog/2015/08/introducing-max-price.ht... Apparently a lot of people could really use that info.

I wonder if this is why I don't get SMS OTP from some apps when I'm abroad and roaming...

Re: Twilio’s toll fraud problem

#187

Post by BonoboIO »

bredren wrote: post #46
toomuchtodo wrote: post #44

Earlier quoted context omitted.

They could, but customers could then file complaints with the FTC and their state’s attorney general for the fraud Twilio is enabling. I strongly encourage Twilio customers to pursue this route if Twilio is charging them for fraudulent charges.

These filings may add up to change at some later time, though are unlikely to provide any kind of near-term actionable remedy.

If they lose the contract with their credit card company... I see people jumping out of windows at the Twilio HQ.

That’s like nuclear meltdown.

Re: Twilio’s toll fraud problem

#188

Post by BonoboIO »

farhadhf wrote: post #183

And to top it off, disabling auto recharge doesn't prevent Twilio from charging your account. They won't charge your card but they won't stop processing requests when your balance reaches 0. We were just hit with toll fraud and even though auto recharge was disabled, they continued processing requests until our balance reached NEGATIVE 4,000 USD and then suspended the account. We received to emails in total: 1. Your…

LOL. Please don’t dispute the charges.

Of course I will.

Re: Twilio’s toll fraud problem

#189

Post by lozenge »

hedora wrote: post #151
Natsu wrote: post #118

Earlier quoted context omitted.

Down thread someone pointed out that their API allows you to set a max price: https://www.twilio.com/blog/2015/08/introducing-max-price.ht... Apparently a lot of people could really use that info.

Why is this not set to zero dollars be default?!? I agree with other comments here. $0 is the minimum amount people should be willing to pay if they're not disputing charges or reporting fraud to the credit card networks / regulators. Time is money, after all.

Even normal phone numbers have a (low) price that varies by country and can change over time, so what would the default be?

Re: Twilio’s toll fraud problem

#190

Post by ThePowerOfFuet »

Nextgrid wrote: post #132
ThePowerOfFuet wrote: post #93

Earlier quoted context omitted.

That warning did not appear in the early days.

That warning actually depends on the “carrier profile”, a configuration file the phone silently fetches (or has cached in firmware builds) based on certain attributes of the SIM like the ICCID or MCC/MNC. There’s a field in there that configured whether that warning should be shown.

Correct, and it didn't appear for carriers which were whitelisted (who zero-rated the iMessage activation SMS).

My memory, which may be wrong, is telling me that the first major version of iOS which included iMessage did not include the warning at all, and that it was added for non-whitelisted carriers (aka those which did not sell the iPhone) to prepare the user for the possibility that they will be billed, based on user feedback precisely like the comment to which I was replying.

Post reply on HN