3 ms·

Here’s how others address it. For phone calls and texts: - Slowly increase velocity limits on new DIDs/TNs. Often, examine the outbound content before raising

Here’s how others address it. For phone calls and texts: - Slowly increase velocity limits on new DIDs/TNs. Often, examine the outbound content before raising limits - is it something anyone would request? where/how? - Require the recipient to have opted-in on the same carrier (ie, no importing lists) - Don’t let the affiliate/reseller sign up customers on their own. Centralize onboarding/KYC. - Verify the end customer’s government-issued ID. For texts: - Block (and flag/escalate) based on message content, like the domain name/URL they’re linking to or a pitch phrase they’ve used.

from 4y ago
> - Verify the end customer’s government-issued ID. This never happens. Lots of PPP or bank fraud investigations go nowhere because the perpetrators used fake IDs all the way down. No company is actually checking the governments database of drivers licenses or state ID cards. Only recently did eCBSV come out which would allow companies to digitally check that an SSN actually exists (mostly to stop synthetic identity fraud) but that still doesn't stop identity theft.
- troydavis 4y ago
  Some of this is about increasing friction, not collecting flawless info. Is it possible to fool Stripe Identity (https://stripe.com/identity https://stripe.com/identity) repeatedly? Probably. But it’s a pain to make new fake docs (or switch carriers) every time an account is flagged.
  - gggggg5 4y ago
    Why is it such a pain? You can print hundreds of good enough fake IDs every day with a sub $1000 printer.
metadat 4y ago
Telcl industry lingo terms I looked up (posting in case this will be helpful to others): DID: Direct Inward Dialing is a method organizations use to route incoming calls to specific private branch exchange (PBX) systems without an operator. Organizations purchase DID numbers from a telephone company or service provider and assign them to individual extensions within the organization. TN: Telephone Number, this initialism is interchangeable with DID. DLC: Installations using Digital Loop Carriers connect analog phone lines of individual users into a single signal sent on single lines to the central office of a phone company. The combined signal is separated into original signals at the central office.
- troydavis 4y ago
  Thank you! One correction - 10DLC is 10-Digit Long Codes. Sometimes this is called “Application-to-Person” (A2P), in contrast to "Person-to-Person" (real people typing on our phones or equivalent). A 10DLC A2P SMS is an SMS sent from a 10-digit number and triggered by API (or anything else automated). Maybe the SMS is your doctor’s appointment confirmation system or an online retailer telling you your order has shipped… or maybe it’s a spammer. If it comes from a 10-digit phone number instead of a 5-6 digit short code, that’s 10DLC. In the last year or so, a registry for 10DLC A2P numbers has emerged (https://www.twilio.com/docs/sms/a2p-10dlc https://www.twilio.com/docs/sms/a2p-10dlc, https://support.bandwidth.com/hc/en-us/articles/4423826434583-10DLC-FAQ https://support.bandwidth.com/hc/en-us/articles/442382643458...), but adoption is mixed, enforcement is low, and end consumers/recipients don’t see any of it. There’s also “Person-to-Person” (P2P) 10-digit SMS, like you texting a friend. Those can also be used to spam (hook up a computer to a consumer SIM), but it’s much less common, especially in the US. Most US-originating SMS spam comes from 10DLC A2P numbers.

from 4y ago

> - Verify the end customer’s government-issued ID. This never happens. Lots of PPP or bank fraud investigations go nowhere because the perpetrators used fake IDs all the way down. No company is actually checking the governments database of drivers licenses or state ID cards. Only recently did eCBSV come out which would allow companies to digitally check that an SSN actually exists (mostly to stop synthetic identity fraud) but that still doesn't stop identity theft.

troydavis 4y ago
Some of this is about increasing friction, not collecting flawless info. Is it possible to fool Stripe Identity (https://stripe.com/identity https://stripe.com/identity) repeatedly? Probably. But it’s a pain to make new fake docs (or switch carriers) every time an account is flagged.
- gggggg5 4y ago
  Why is it such a pain? You can print hundreds of good enough fake IDs every day with a sub $1000 printer.

metadat 4y ago

Telcl industry lingo terms I looked up (posting in case this will be helpful to others): DID: Direct Inward Dialing is a method organizations use to route incoming calls to specific private branch exchange (PBX) systems without an operator. Organizations purchase DID numbers from a telephone company or service provider and assign them to individual extensions within the organization. TN: Telephone Number, this initialism is interchangeable with DID. DLC: Installations using Digital Loop Carriers connect analog phone lines of individual users into a single signal sent on single lines to the central office of a phone company. The combined signal is separated into original signals at the central office.

troydavis 4y ago
Thank you! One correction - 10DLC is 10-Digit Long Codes. Sometimes this is called “Application-to-Person” (A2P), in contrast to "Person-to-Person" (real people typing on our phones or equivalent). A 10DLC A2P SMS is an SMS sent from a 10-digit number and triggered by API (or anything else automated). Maybe the SMS is your doctor’s appointment confirmation system or an online retailer telling you your order has shipped… or maybe it’s a spammer. If it comes from a 10-digit phone number instead of a 5-6 digit short code, that’s 10DLC. In the last year or so, a registry for 10DLC A2P numbers has emerged (https://www.twilio.com/docs/sms/a2p-10dlc https://www.twilio.com/docs/sms/a2p-10dlc, https://support.bandwidth.com/hc/en-us/articles/4423826434583-10DLC-FAQ https://support.bandwidth.com/hc/en-us/articles/442382643458...), but adoption is mixed, enforcement is low, and end consumers/recipients don’t see any of it. There’s also “Person-to-Person” (P2P) 10-digit SMS, like you texting a friend. Those can also be used to spam (hook up a computer to a consumer SIM), but it’s much less common, especially in the US. Most US-originating SMS spam comes from 10DLC A2P numbers.