2 ms·
I wouldn't be surprised if the fraudster used Twilio's own platform to send the phishing SMS to its own employees. If this is in fact the case, I wonder if Twi
by alberth 4y ago
I wouldn't be surprised if the fraudster used Twilio's own platform to send the phishing SMS to its own employees.
If this is in fact the case, I wonder if Twilio becomes even more liability for such customer damages. Note: additionally, Twilio uses it's own Authy for MFA.
- kelnos 4y agoThis isn't the case. I'm a former employee, and received these phishing emails after I left the company (I just got two on Sunday, and I've been gone over 5 months). I used Twilio's number lookup API[0], and they're not Twilio numbers. They were both T-Mobile numbers, and one of them even had a caller name that looked like the number was associated with a retail consumer SIM card. Possibly a cloned or stolen SIM? Twilio has really stepped up KYC efforts over the past couple years. I don't think an anonymous attacker could send this volume of messages through the platform without getting noticed. And if they were using Twilio to send these messages, it would have been trivial to block them. [0] https://www.twilio.com/docs/lookup/api https://www.twilio.com/docs/lookup/api