8 ms·

This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that origi

This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that original number. The business case of relaying inbound text messages to an employee's phone number should be a very common one and should not warrant an account suspension.

YXNjaGVyZWdlbgo 5y ago
The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you are looking at the problem objectively twilio is in the right.
- Turing_Machine 5y ago
  Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario under which this is the customer's fault.
  - YXNjaGVyZWdlbgo 5y ago
    You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.
    - ejb999 5y ago
      >>You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes. As opposed to just shutting down the customer because TWILIO forwarded the spam, that we already know that it can detect?
      - YXNjaGVyZWdlbgo 5y ago
        If you have a business that deals with spam texts or if you host a honeypot for whatever reason you are allowed to do it. You are allowed to receive spam and do whatever you want with it except sending spam over twilio itself because it's against their ToS and to protect their own core business from getting their numbers blacklisted.
    - em-bee 5y ago
      if twilio can not differentiate between inbound messages that are being forwarded and outbound messages that are created by the twilio customer then their service can't guarantee to be reliable because someone could basically create a DOS attack by sending spam to any twilio customer expecting that twilio will blame their customer and suspend the account.
      - YXNjaGVyZWdlbgo 5y ago
        It's not their job to differentiate they are just a carrier they scan for outgoing spam to protect their own core business and to not get blacklisted everywhere. Read the ToS they are pretty specific about it.
        em-bee 5y ago
        but then they are simply not suitable for the use case of forwarding inbound messages because the risk is to great that i'll get shut down just because i am receiving spam.
        YXNjaGVyZWdlbgo 5y ago
        Yes.
    - mbreese 5y ago
      The are otherwise curating the data and calling it spam on the outbound, so… yes?
      - eropple 5y ago
        They're receiving the spam because it's sent to the customer. They're sending spam when the customer asks. They're also deciding that that customer is a customer no longer because of the choices that customer made with regards to sending spam, not receiving spam. These are pretty different things.
      - YXNjaGVyZWdlbgo 5y ago
        Because they have made it pretty clear in their ToS that it is forbidden to send any form of spam over their network.
    - Turing_Machine 5y ago
      Umm... "curating the data" is exactly what they're doing when they ban the customer for forwarding spam that originated from their system.
      - YXNjaGVyZWdlbgo 5y ago
        twilio might not care but the carriers the messages get send to will.
  - ohyeshedid 5y ago
    ...or the complaints that caused the account suspension didn't come from Twilio. More than likely, the employee cell carrier noticed the spam and sent an automated complaint to Twilio, and then Twilio acted. That doesn't excuse poor support, and the lack of resolution, but it changes a lot of the assumed processes.
  - stefanve 5y ago
    imagine that email providers would have used the Twilio way......
- soco 5y ago
  And where are those people receiving the spam message in the first place? From Twilio's system right. If they are so good at detecting it circulating internally, why didn't they detect it and block it in the first place?
  - YXNjaGVyZWdlbgo 5y ago
    It is simply against the ToS to send spam over twilios network. Objectively this is what OP is doing. You are allowed to receive spam maybe your core business even depends on getting spam numbers or analyzes the spam for phishing links itself. You can receive and ingest it in anything you want you just can't send it over twilio yourself. Sorry this is not a design flaw this is just a bad workflow.
    - _hyn3 5y ago
      This is absolutely a Twilio design flaw. It's an incredibly common use case to forward text messages from one incoming line to another number that is controlled by your company, and it's impossible to tell at the point of receipt (when it's still in Twilio's network) whether it's spam or not before forwarding it on. It's the same exact thing that you might do if you have a support@example.com email address; it probably sends incoming emails to a number of different inboxes, even if those incoming emails are spam (and even if there actually is a spam system in place that might block some percentage of incoming messages, and Twilio doesn't even provide that.)
      - YXNjaGVyZWdlbgo 5y ago
        Twilio is a carrier and nothing else by having zero tolerance against outgoing spam they are protecting their own core business. If OP or you in that regard would even glimpse at their ToS instead of just scrolling by when your business depends on it OP would not have made this user error.
        Sohcahtoa82 5y ago
        What they're getting at is that Twilio clearly already has the capability of automatically detecting spam. Why not open that capability to an API so that somebody who is operating some sort of forwarding service to run spam detection before forwarding?
- ChrisDutrow 5y ago
  I did mitigate the problem last time. I communicated with them and they told me it was fine. I'm very curious. Is this a communication mistake? Like do you think I'm some big company that forwards text messages to random people? Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so. Your question about GDPR requests makes me think maybe you have misunderstood the context. If you have correctly understood the context, do you actually think I should have some kind of AI algorithm scanning these messages for Phishing? I'm not sure I understand what your are suggesting or how you would have solved this problem? You would have just turned off the text message forwarding I guess? Is that how you solve problems? You see a problem, then you destroy the thing that caused the problem, so problem solved? What do you do for a living with that type of cognitive approach? Are you an entrepreneur? Do you really run a business with that attitude? Are you en engineer? If so, when you are asked to make something work, do you just tell your boss "no" if you run into a problem that requires a creative solution? Are you a lawyer? Is your job to tell people what thing they cannot do, but not to help people do new things? That would kind of make sense...
  - YXNjaGVyZWdlbgo 5y ago
    It's not even good business practice you are paying for something that is essentially free if implemented in every other way. This is not creative this abusing a system going against their ToS and blaming them for your own failure. I am suggesting you ingest the received messages and distribute it any other way like a lot of twilio customers probably do. This is merely a hack and a bad one at that.
    - ChrisDutrow 5y ago
      - deleted 5y ago
        [deleted]
      - YXNjaGVyZWdlbgo 5y ago
jlundberg 5y ago
This is actually technically possible in the networks, at least here in Europe (generally). However, obviously allowing such sms forwarding have to be done with care.
- ChrisDutrow 5y ago
  Yes I think you are right. But I don't think Twilio allows it unless I somehow register the number and authenticate that I own. I could be wrong, but I think they have a way for me to register my cell number so I could "spoof" messages sent from it. But I would first have to prove to them that I own the number.

YXNjaGVyZWdlbgo 5y ago

The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you are looking at the problem objectively twilio is in the right.

Turing_Machine 5y ago
Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario under which this is the customer's fault.
- YXNjaGVyZWdlbgo 5y ago
  You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.
  - ejb999 5y ago
    >>You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes. As opposed to just shutting down the customer because TWILIO forwarded the spam, that we already know that it can detect?
    - YXNjaGVyZWdlbgo 5y ago
      If you have a business that deals with spam texts or if you host a honeypot for whatever reason you are allowed to do it. You are allowed to receive spam and do whatever you want with it except sending spam over twilio itself because it's against their ToS and to protect their own core business from getting their numbers blacklisted.
  - em-bee 5y ago
    if twilio can not differentiate between inbound messages that are being forwarded and outbound messages that are created by the twilio customer then their service can't guarantee to be reliable because someone could basically create a DOS attack by sending spam to any twilio customer expecting that twilio will blame their customer and suspend the account.
    - YXNjaGVyZWdlbgo 5y ago
      It's not their job to differentiate they are just a carrier they scan for outgoing spam to protect their own core business and to not get blacklisted everywhere. Read the ToS they are pretty specific about it.
      - em-bee 5y ago
        but then they are simply not suitable for the use case of forwarding inbound messages because the risk is to great that i'll get shut down just because i am receiving spam.
        YXNjaGVyZWdlbgo 5y ago
        Yes.
  - mbreese 5y ago
    The are otherwise curating the data and calling it spam on the outbound, so… yes?
    - eropple 5y ago
      They're receiving the spam because it's sent to the customer. They're sending spam when the customer asks. They're also deciding that that customer is a customer no longer because of the choices that customer made with regards to sending spam, not receiving spam. These are pretty different things.
    - YXNjaGVyZWdlbgo 5y ago
      Because they have made it pretty clear in their ToS that it is forbidden to send any form of spam over their network.
  - Turing_Machine 5y ago
    Umm... "curating the data" is exactly what they're doing when they ban the customer for forwarding spam that originated from their system.
    - YXNjaGVyZWdlbgo 5y ago
      twilio might not care but the carriers the messages get send to will.
- ohyeshedid 5y ago
  ...or the complaints that caused the account suspension didn't come from Twilio. More than likely, the employee cell carrier noticed the spam and sent an automated complaint to Twilio, and then Twilio acted. That doesn't excuse poor support, and the lack of resolution, but it changes a lot of the assumed processes.
- stefanve 5y ago
  imagine that email providers would have used the Twilio way......
soco 5y ago
And where are those people receiving the spam message in the first place? From Twilio's system right. If they are so good at detecting it circulating internally, why didn't they detect it and block it in the first place?
- YXNjaGVyZWdlbgo 5y ago
  It is simply against the ToS to send spam over twilios network. Objectively this is what OP is doing. You are allowed to receive spam maybe your core business even depends on getting spam numbers or analyzes the spam for phishing links itself. You can receive and ingest it in anything you want you just can't send it over twilio yourself. Sorry this is not a design flaw this is just a bad workflow.
  - _hyn3 5y ago
    This is absolutely a Twilio design flaw. It's an incredibly common use case to forward text messages from one incoming line to another number that is controlled by your company, and it's impossible to tell at the point of receipt (when it's still in Twilio's network) whether it's spam or not before forwarding it on. It's the same exact thing that you might do if you have a support@example.com email address; it probably sends incoming emails to a number of different inboxes, even if those incoming emails are spam (and even if there actually is a spam system in place that might block some percentage of incoming messages, and Twilio doesn't even provide that.)
    - YXNjaGVyZWdlbgo 5y ago
      Twilio is a carrier and nothing else by having zero tolerance against outgoing spam they are protecting their own core business. If OP or you in that regard would even glimpse at their ToS instead of just scrolling by when your business depends on it OP would not have made this user error.
      - Sohcahtoa82 5y ago
        What they're getting at is that Twilio clearly already has the capability of automatically detecting spam. Why not open that capability to an API so that somebody who is operating some sort of forwarding service to run spam detection before forwarding?
ChrisDutrow 5y ago
I did mitigate the problem last time. I communicated with them and they told me it was fine. I'm very curious. Is this a communication mistake? Like do you think I'm some big company that forwards text messages to random people? Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so. Your question about GDPR requests makes me think maybe you have misunderstood the context. If you have correctly understood the context, do you actually think I should have some kind of AI algorithm scanning these messages for Phishing? I'm not sure I understand what your are suggesting or how you would have solved this problem? You would have just turned off the text message forwarding I guess? Is that how you solve problems? You see a problem, then you destroy the thing that caused the problem, so problem solved? What do you do for a living with that type of cognitive approach? Are you an entrepreneur? Do you really run a business with that attitude? Are you en engineer? If so, when you are asked to make something work, do you just tell your boss "no" if you run into a problem that requires a creative solution? Are you a lawyer? Is your job to tell people what thing they cannot do, but not to help people do new things? That would kind of make sense...
- YXNjaGVyZWdlbgo 5y ago
  It's not even good business practice you are paying for something that is essentially free if implemented in every other way. This is not creative this abusing a system going against their ToS and blaming them for your own failure. I am suggesting you ingest the received messages and distribute it any other way like a lot of twilio customers probably do. This is merely a hack and a bad one at that.
  - ChrisDutrow 5y ago
    - deleted 5y ago
      [deleted]
    - YXNjaGVyZWdlbgo 5y ago

jlundberg 5y ago

This is actually technically possible in the networks, at least here in Europe (generally). However, obviously allowing such sms forwarding have to be done with care.

ChrisDutrow 5y ago
Yes I think you are right. But I don't think Twilio allows it unless I somehow register the number and authenticate that I own. I could be wrong, but I think they have a way for me to register my cell number so I could "spoof" messages sent from it. But I would first have to prove to them that I own the number.