Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio’s toll fraud problem

billychasen.medium.com

Post reply on HN
Print view View original

121–130 of 221 posts

Re: Twilio’s toll fraud problem

#121

Post by dahfizz »

8n4vidtmkvmk wrote: post #105
charcircuit wrote: post #103

Earlier quoted context omitted.

Why would the card providers be in the customer's favor. The customer paid for a text to be delivered to a phone number and Twilio did that and then charged the customer for it. If you pay someone to mow your lawn, then they mow your lawn and charge you. You can't just chargeback after the fact to get that service for free.

if they mow your lawn 10 times in a row and bill you 10 times... you should charge back 9 of them

Is that what's happening? You ask twilio to send one text and they send ten?

Re: Twilio’s toll fraud problem

#122

Post by robbiep »

startledmarmot wrote: post #91
mxuribe wrote: post #20

Earlier quoted context omitted.

Same here! So, i wonder then, who would be a viable alternative to Twilio?

Hey! I'd naturally recommend SignalWire (as one of the founders over there.) We have a full messaging + voice + video APIs, including a Twilio-compatible API just for people who need to switch. We're backed by companies like Deutsche Telekom, T-Mobile, and Samsung so we know how to make telecom infra! https://signalwire.com/products/cloud-messaging We're also the folks behind the open-source FreeSWITCH framework that…

How are you preventing the type of attack that is being described here?

Thanks

Re: Twilio’s toll fraud problem

#123

Post by ljm »

Teever wrote: post #72
bragr wrote: post #50

Earlier quoted context omitted.

>Your only power to encourage them to fix this is to do the thing they're begging you not to: dispute the charges. I'd check their TOS to see if they offer some kind of arbitration option. As noted in other threads, triggering that process can be a surprisingly effective way to make someone from the company actually engage with the issue. Disputing the charges is always a nuclear option. They may never do business wi…

> Disputing the charges is always a nuclear option. They may never do business with you after that. This is something that I think needs to be regulated. I'm not saying that this should be the case for a company the size of Twilio, but I definitely think that a company the size of Apple/Google/Samsung should not be able to ruin your life because you had temerity to stand up to them and dispute a charge.

It’s a shame that regulation has failed to keep up with tech. It’s not exactly the first time we’ve had a gold rush or a lawless wild-west situation.

The west still prospered when consumer rights were given priority over business.

Re: Twilio’s toll fraud problem

#124

Post by Spooky23 »

yjftsjthsd-h wrote: post #4
woofcat wrote: post #2

https://nitter.kylrth.com/benjaminnetter/status/153085292888... If you want to read the tweet on how it works.

I'm surprised/confused: Why is it hard to detect premium rate numbers, or at least set a flag to not allow sending to them? Like, I can't think of a time when twillo should ever be sending to a premium rate number; why is this even possible?

Honestly, I can’t think of a legitimate use case for toll SMS.

Re: Twilio’s toll fraud problem

#125

Post by snake_plissken »

I've read through a lot of the responses and I am still kind of confused how the fraud actually works:

1) Scammer leases a "premium phone number" from a provider. From doing some reading, premium numbers are where the caller/texter pays extra for interacting with the service at this number. So like a 1-900-phone-sex line from back in the day, where if you call, you get charged like $5.00 a minute. The provider leased the number to the phone sex operator for $1 per minute. The phone sex operator runs the service and charges access via your telco at $5 a minute, and ends up netting $4. The telco bills you $5 for your 1 minute call.

2) In Twilio's case, they get a request to send a text to a premium phone number leased by the scammer. This text is actually initiated by the scammer, via something like requesting a new one-time password. Twilio sends the text.

3) Twilio then determines that the destination number is a premium phone number. Twilio charges you extra for sending the text because of this. Twilio then remits a payment to someone, either the scammer or the premium phone number provider.

4) Scammer repeats step 3 a very large amount of times and collects. Twilio bills you for all of those texts they sent, on your behalf, to the scammer's premium number.

Step 3 is where I am confused. How do the payment flows work. Is Twilio remitting the money to the scammer, who then needs to pay for the leased number? Or are they remitting the payment to the premium phone number provider, who then pays some portion of that to the scammer?

And come to think of it, how does the phone sex line example work? Which entity actually contracts with the telco to set the cost/toll?

Re: Twilio’s toll fraud problem

#126

Post by nfm »

techsupporter wrote: post #23
nfm wrote: post #16

Earlier quoted context omitted.

Solving this is squarely Twilio's business! They know how much to bill the customer, so they must know how much it costs to send to a number.

> They know how much to bill the customer I don't mean to do Twilio's work of defending them, but in my experience it's possible they actually don't know how much to bill the customer. What they may know is the generalized per-minute or per-session rate they've agreed with another operator alongside a general "premium rate numbers will be settled at a later date" kind of clause. My employer got bit by this several ye…

Surely they can aggregate this across all customers though.

If Twilio cops an unexpectedly high settlement for sending an SMS to +1234567890 in January, can they assume that a separate customer sending an SMS to that number in February will end up in the same boat?

I'd be very surprised if the toll fraudsters weren't using the same numbers to hit multiple Twilio accounts.

Re: Twilio’s toll fraud problem

#128

Post by kevincox »

macinjosh wrote: post #114
mike_d wrote: post #107

Earlier quoted context omitted.

Which seems like a super easy fix for Twilio to implement. Don't allow SMS to premium rate numbers. If they can identify the premium numbers for billing, they should be able to identify them for blocking.

I would imagine there are rules/regulations about a SMS provider blocking communications before fraudulent behavior is determined? Not saying it shouldn't/couldn't be done, but probably one of those things with a simple tech fix but a complicating social/business aspect.

It could be an option in the API call with a default in account settings. I bet most people who are trying to reduce spam accounts by requiring a phone number would actually prefer to exclude these numbers anyways.

Re: Twilio’s toll fraud problem

#129

Post by mylidlpony »

ridgered4 wrote: post #59
nebula8804 wrote: post #13

Isn't this something Elon Musk brought up a few weeks ago when Twitter SMS 2FA stopped working in some countries? (India? I think?). On a Twitter spaces he said they were losing millions to SMS fraud for years and found out that some Telecom companies were complicit so they just cut off all SMS traffic to those companies until they re-negotiated terms.

Last time I tried to sign up for Twitter it demanded I verify my account with text messages. Actually, virtually all services do this now when creating an account. The worst (Microsoft for example) let you sign up and use the account for a bit (possibly purchasing some items tied to the account) and then extort the phone number out of you later to maintain access. It is sort of amusing that these companies hitched th…

TBH I would consider this type of fraud of a more Robin Hood variety. Companies that still encourage weak security practices like sms 2fa (or even worse, just hoover your PII under the guise of it) should be defrauded of their money as much as possible.

Re: Twilio’s toll fraud problem

#130

Post by iamleppert »

Is it not possible to ban pay Toll numbers in 2FA applications? Why doesn't Twilio do this by default? I would absolutely dispute the charge. Or better yet use only virtual credit cards for these services like Twilio that cannot be trusted, with fixed spending limits and monitor them closely.
Post reply on HN