13 ms·
SMS traffic pumping fraud
- bagels 3y agoWhy isn't the top solution "check this box to prevent your account from sending sms to scammer toll numbers"?
- mdasen 3y agoThey're not toll numbers. They're regular numbers. Mobile networks get paid a small amount of money for delivering SMS messages. Let's say that they get paid $0.003/message. Let's say you're a small mobile network and I bribe you or make a deal with you: I'll get lots of messages sent to mobile devices on your network and you'll pay me $0.001/message. That's good for you as the mobile network and good for me since I get money. So I get a list of numbers on your network and start filling them into any form that will send a text to that number. There is no "don't send messages to scammer toll numbers" option because these aren't toll numbers. They're regular numbers. I mean, Twilio could probably easily detect this behavior themselves and prevent it. As they note, they often cycle through adjacent numbers and do it in a quick fashion. However, the numbers aren't scam/toll numbers as a category. You'd need to use ML/heuristics to find these.
- Osmose 3y agoTwilio does attempt to detect this behavior and block it, that's what Twilio Verify is.
- pcthrowaway 3y agoYeah, but they could do it as part of their basic service because it would make customers happy. They don't though, because they also make money from it
- supertrope 3y agoWhen the service provider is liable for fraud losses they use the latest best practices. When the customer eats the loss they can just throw up their hands and say you should have used xyz security feature.
- foobiekr 3y agoBetter would be: [X] Only send to low/no settlement peers (default)
- msh 3y agoThe phone system of the world is sooo broken but too entrenched to replace with something reasonable.
- resonious 3y agoWhat would be a reasonable replacement?
- civilitty 3y agoI vote for hand grenades.
- nurple 3y agoZMQ of course! In all seriousness, I’ve always found the author’s odd rant on the contemporary wireless communication system quite interesting. In my mind, the issues with the current system are not so much technical as they are regulatory. There are many industries where artificial scarcity is captured by bribing… errr buying the right to that control from the Gov (while competition is held off using their monopoly on violence). Sending an SMS, especially these days, costs on the order of sending a single TCP packet over the Internet. Together with the payment industry, we’ve been duped out of trillions in usage fees for tech that was invented and put into use by hobbyists for decades before the rent seekers showed up. https://zguide.zeromq.org/docs/chapter8/ https://zguide.zeromq.org/docs/chapter8/
- pcthrowaway 3y agoThe zmq docs are a treasure. The section in that chapter about building service discovery from scratch on a local network is one of the best technical guides I've read
- smt88 3y agoGP is likely referring not to the implementation, not the product itself. The phone system was not built with basic modern necessities like authentication. You don't know that the number on your caller ID is actually owned by the person calling you, for example. A better system would have an authentication scheme and encryption for sure. As we've seen from RCS and iMessage, it doesn't need to sacrifice backward compatibility, either.
- malux85 3y agoCan someone explain this attack a bit clearer please? If my server is sending a 2FA to a mobile number, then I control the number and the content of the message, so how does the attacker send to blocks of numbers and profit from the traffic (I'm guessing they need to put a link in the message?) Does it only happen with poorly written forms that have no validation so the attacker can control the target number and the message that gets sent?
- sublinear 3y agoThe fraudster creates new accounts on your service for each of these phone numbers. They don't care about verifying the 2fa code. They just care that you send a text to those numbers.
- CaveTech 3y agoYou don't control the number. When signing up for a service or setting up SMS 2FA, you need to initiate the process by inputting a number. Attackers input numbers that are very expensive to route to, and since SMS is not a flat rate service, when this happens at volume it gets very expensive very quickly. I've seen really scummy MNO's costing around ~25 cents per SMS.
- yosito 3y agoThought experiment: Maybe if enough of us do it, companies will stop forcing us to use SMS for 2FA and let us use a proper authentication device instead.
- Modified3019 3y agoLet the malady be the cure.
- malux85 3y agoOh I see they profit from the fact that I'm charged to send the SMS, I thought they were profiting from the end user visiting a link (and generating ad revenue) Thanks for explaining!
- CaveTech 3y agoTwilio has been complicit in this problem for years, and up until very recently put 0 effort behind tooling to allow customers to block it off from the top. Instead the world toiled away on what is surely several hundred engineer lifetimes of hours building the same fraud guard solutions in front of Twilio. Wonderful piece of propaganda that Twilio can put out to pretend to be a thought leader in the space while turning a blind eye to the tens of thousands of dollars of fraud passing over their wires on the daily.
- nurple 3y agoNot only that, but they now have an "SMS Pumping Risk" API endpoint(1) that costs 3.5c per request(2). I guess the demand is there... but feels pretty exploitative at this point. 1. https://www.twilio.com/docs/lookup/v2-api/sms-pumping-risk 2. https://www.twilio.com/en-us/trusted-activation/pricing/lookup
- yashap 3y ago100%, my current company had to build fraud protection specifically for our Twilio SMS OTP flow. I’m sure essentially every Twilio customer that does SMS OTP flows with them has had to do the same. Took them forever to build their own feature for this, despite it being SUCH a common issue, and now they charge extra for it.
- primitivesuave 3y agoThe most innocuous explanation is someone in management asking "if someone tells us (via API request) to send an SMS to a certain number, and we don't send that message because we're 99% sure they're being defrauded, how do we communicate that to the customer, and what about that 1% chance we're wrong?" Although the most likely explanation is someone in management going "hold on, we have to spend money to build these safeguards, and we're going to make less money after we deploy them?"
- steelaz 3y agoCouldn't agree more. Twilio has been profiting from these scammers for years. We had several calls with our account manager and "fraud expert", and the answer was always the same - migrate to Twilio Authy. The problem is that with Twilio Authy you are basically paying the same amount, it's just that the cut or "protection fee" is not going directly to scammers, but to Twilio. The last time we talked to them, they bragged about how good their algorithm to detect fraud is and that we should take advantage of it by onboarding to Authy. I asked them why they just don't offer it to all customers, since their platform is enabling scammers. And the manager said, I'm paraphrasing here, "well, we are for profit company".
- punnerud 3y agoSMS can be withdrawn from the phone after receiving them, if they include a special ID. Is there any operators that have used this for deleting SMS if they later find that this is fraud/spam?
- mysterypie 3y agoI never heard of that. Could you talk more about how that works, what's it's officially called, and what the intended use is? Would it literally delete the SMS as you're looking at it? On any kind of cellphone?
- jabroni_salad 3y agoThat's just how GSM is. Keep in mind that back in the day, your device attached to the modem might not have been very smart or interactive. The service center has the ability to CRUD everything on the modem via AT commands. Your keyword is AT+CMGD Things are probably more complex on modern smartphones but I had to learn all this crap for an arduino project.
- yosito 3y agoThe best way to avoid this as a company is to not use SMS to implement 2FA!
- seanthemon 3y agoImpossible if your customers are enterprise.
- pnpnp 3y agoWeird. My fortune 100 company doesn’t use SMS for 2FA.
- kristofferg 3y agoIt is still very common for business clients of all sizes, in all industries (even critical infra) to request 2FA via SMS. Good for the company you work for that they dont :)
- yosito 3y agoWhen they request it, they should receive pushback. SMS 2FA is a bad business decision with potentially severe consequences for customers.
- cbzoiav 3y ago"We recommended you went for X and listed SMS security problems as the reasons - here is the email chain" You need to cover your ass, but you don't want to actively push back and risk losing the sale.
- throwaway2037 3y agoI assume that all of Fortune 500 (minus tech majors) use RSA hard and soft tokens. Ref: https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID
- kbar13 3y agothis is another drop in the bucket of "stop using SMS for any form of authentication"
- technick 3y agoSMS is the only way to get 2fa with a dumb phone and without a physical 2fa token.
- joshuaissac 3y ago> SMS is the only way to get 2fa with a dumb phone and without a physical 2fa token. TOTP authenticator apps exist for J2ME, which is supported by phones as old as the Nokia 3330. Example: https://github.com/baumschubser/hotpants https://github.com/baumschubser/hotpants
- viknesh 3y agoI used to work on a related problem (call traffic pumping) for a large VOIP provider, for domestic & international calls. It was a very interesting problem which has two distinct patterns of abuse. First is just basic account takeover/hijacking, where a criminal will login to your account and receive a cut for calling expensive numbers (or in this case, sending SMS's to them). This is basically the web version of the pre-existing PBX hijacking issue. The second, more interesting version, is people abusing free quotas to send calls (or SMS), such as in the verification case. This is novel (relative to the pre-web era) because historically it would have been hard to make free calls/texts.
- chx 3y agoAs an aside, PBX hijacking was how certain Fido BBS operators in the early 90s Hungary got their feed from abroad: a friendly installer left an extension in the PBX of the largest consumer bank which gave you a dial tone so very expensive calls abroad were billed to the bank. This went on for a few years.
- yuvadam 3y agoI've seen this attack first hand, causing a company thousands of dollars of damage (not including dev hours to resolve). The exploit was on a mobile app that required phone verification upon initial onboarding, way before any other authentication can be performed. That made it relatively hard to reinforce the onboarding API call that triggers SMS. It's a nasty problem, and effectively an arms race.
- dudeinjapan 3y agoWhich MNOs are known to be doing this?
- apienx 3y agoPlease use secure channels for authentication. SMS is antiquatedly insecure (Any way it's sent: SS7, SMPP, etc.). More traffic benefits the industry (since some sucker pays for it). There's no incentive for any of the entities that profit from this to stop it (unless it's too sell you a premium protection service).
- jnwatson 3y agoNIST recommended getting off SMS in 2016. I’d say 7 years is plenty of time that folks really shouldn’t be using it. https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...
- ComodoHacker 3y agoMeanwhile, there are countries whose entire banking, tax filing, CC processing and various public service systems rely on SMS as the only second factor.
- vladvasiliu 3y agoI don't know about those countries, but I know of one who says it's trying to compete with the US on tech, and one of their biggest banks moved away from hardware TOTP tokens to some kind of "secure app" and now to... SMS! To name and shame: BNP in France. My personal account stayed on the app, but for my company account, it I only get SMS now.
- KronisLV 3y ago> To name and shame: BNP in France. My personal account stayed on the app, but for my company account, it I only get SMS now. I remember a story about a university in Lithuania also opting for either SMS or a proprietary 2FA app, but not allowing TOTP either: https://fsfe.org/news/2023/news-20230418-01.html https://fsfe.org/news/2023/news-20230418-01.html What's worse, all they had to do was enable a checkbox in the settings somewhere but they went on an embarrassingly long e-mail thread back and forth, not even willing to help the users. So I think that in cases like that, it's definitely a good idea to call attention to the issue and tell more people about open technologies like that! Unfortunately, most people just won't care. That said, TOTP is actually decent and I'm surprised that it's not supported everywhere, especially given how much shouting about SMS not being secure enough goes around.
- firecall 3y agoCan someone explain the Revenue Generation part? They used some jargon in the intro and didn’t really understand how that worked! How the Revenue Sharing works wasn’t well explained :-)
- letharion 3y agoI didn't fully understand it either, but my take is this: 1. Twilio (or someone else) sends a text message for OTP. 2. This message needs to pass through my carrier (MNO, in the article) for delivery, and my carrier charges Twilio and/or their carrier, for the service. This is the revenue mentioned. 3. I have an agreement with my carrier, or simply form my own, that we split revenue.
- technick 3y agoThis is a correct understanding
- foolfoolz 3y agoto send a message (or call) to a phone number the sender of the message has to pay the company that owns the recipient number a fee. the fee varies. in the u. s. it’s very small. less than a penny. in some undeveloped countries it’s much higher. most fraud like this occurs in those countries with higher fees let’s say i make friends with a mobile network operator in a country with high fees. i tell that mobile network i can send a lot of traffic to your network and generate you revenue in message passing fees. but i need to get a share of the money. the mobile network operator understands my methods are not legit and will not block the traffic / apply normal spam / anti fraud protections. we both make money at the expense of the message sender
- rzmmm 3y agoThe key here is that sometimes receiving a SMS costs money. So the attacker creates the fake traffic for the operator, operator generates revenue and then pays the attacker.
- xyst 3y agoYet another reason why SMS should never be used as 2FA
- technick 3y agoI had to deal with this at work a few months ago with Twilio. Turned on the SMS fraud filter and it does a pretty good job at catching these scammers.
- doron2402 3y agoThat's a known issue; there are a number of companies in YC that have had to pay thousands of dollars to Twilio. The way I've worked around this issue is by: - Verifying the phone number before sending SMS. - Using a whitelist of supported countries. - Limit the amount Twilio can charge us Hope that helps
- mraison 3y ago> Limit the amount Twilio can charge us This is unfortunately easier said than done. You'd expect Twilio to let you set a max spending limit in your account settings. Instead this is what they tell you to do: https://support.twilio.com/hc/en-us/articles/223132387-Protect-your-Twilio-project-from-Fraud-with-Usage-Triggers https://support.twilio.com/hc/en-us/articles/223132387-Prote... (notice the PHP snippet too) Essentially, setting up a webhook to receive alerts from Twilio, and then calling a Twilio API to suspend the account. Your webhook better be up and running flawlessly if you don't want to go bankrupt. Why can't they do it themselves?
- citrin_ru 3y ago> Using a whitelist of supported countries. This may unnecessary discriminate people from countries which is not your main market and digital nomads using local SIMs. Better is to have per-country (or even per-operator) rate limits which are low by default but high for countries you have a lot of users from.
- cco 3y agoIf any YC companies are running into this, hit me up at chris ampersand stytch.com. We have a great YC deal and can stop toll fraud eating your dollars.
- tripue 3y agoWe faced the same problem at Zenly and had to build our own anti-spam strategies to prevent it. We used multiple providers to improve our conversion rate and reduce cost. We are now building this as a service https://www.ding.live/ https://www.ding.live/ and are seeing huge improvements for our first customers in term of cost savings and conversion rate. Feel free to reach out if it could be any interest to you hello@ding.live.
- fasteo 3y agoThere is no way you are using high-quality routes for the "lowest price"[1] (just checked some random countries I have direct experience with) Spain 0.0094 Italy 0.0159 Germany 0.0198 Most likely, your upstream providers are using SIM farms High quality routes - either direct operator connections or 1-hop - will have these aprox pricing Spain ~0.021-0.023 Italy ~0.026-0.030 Germany ~0.06-0.07 [1] https://dinglive.notion.site/SMS-e03051265199429cb36aed17bac6bb96 https://dinglive.notion.site/SMS-e03051265199429cb36aed17bac...
- tripue 3y agoWe use a combinaison of route that are are evaluated in real-time for their cost to conversion ratio. Our customers have the option to choose only « direct routes » if needed but those strategies are use at scale by players like Facebook, TikTok or Google we’re just making sure our customer have all the options, visibility and control on their conversion rate/price tradeoff. Another strategy that allows to lower cost significantly is the use of alternative channel when available and competitive : Google RBM, WhatsApp, Viber, line.. Last but not least we don’t do any margin on the sms price so we bill back exactly what we pay for and negotiate with aggregated volumes.
- fasteo 3y ago>>> evaluated in real-time for their cost to conversion ratio We tried that in the past, but our business (mostly OTP for banks) do not allow any margin of error at all. The thing is that we would get positive delivery reports which were fake. We also tried some 3rd party testing tools (Testelium[1], TestMySMS[2], etc) but again, our hacky upstream providers were ahead of us and they would put those test number in white-list so that everything would look just fine when testing. At the end, we settled for direct or 1-hop connection. Margins are tight, but this is the only way to offer a high quality service. Of course, YMMV [1] https://testelium.com/ https://testelium.com/ [2] https://www.testmysms.com/ https://www.testmysms.com/
- lormayna 3y agoThis is just a new variant of an old attack. I have been working for a VOIP provider 10 years ago and the attack was similar: the attackers compromise a VOIP PBX (default passwords, extensions opened in the WAN, etc.) and then use it to call a very expensive value added service that they owned (like one special number in Tristan De Cuna or Nauru that costs 50€ at the reply and 10€ at minutes).
- cco 3y agoHuge problem we see at my current company, Stytch (https://stytch.com/ https://stytch.com/). Toll fraud/traffic pumping can result in huge costs, mid thousands to millions per year. One thing that surprised me a lot to learn, and is covered in the article, is that the primary bad actor is the telecom provider! I had no idea that the telecoms were sharing revenue with hackers that found unprotected SMS channels and exploited them. A really wild thing. We have a bunch of built in protection against SMS toll fraud for our OTP product as well as more in-depth fingerprinting tools if your app ever runs into this problem. When you get that first surprise bill from Twilio, give us a shout and we can help!
- detuur 3y agoThe wild thing about this is that this isn't just a B2B fraud, but regular joes are hit with it as well and regular operators don't care. My phone got stolen in Naples last year, just as I was about to board my plane. It was 11PM, so when I called my boss from my gf's phone he decided to block the number the next morning as he was in bed already. By the time the SIM was blocked, 10 hours had passed, and thieves had managed to place over 100 hours of very expensive toll calls to numbers in Algeria. It cost the company over 10k, and our operator was not willing to accept any responsibility over it. Admittedly, I turned off the PIN lock because my phone at the time would overheat and restart multiple times a day, but operators really should have lockouts on foreign payphone numbers, especially once they're being placed faster than a human can dial them.
- testingss 3y ago[flagged]
- Arathorn 3y agoThis is why we turned off phone number verification on matrix.org.
- taf2 3y agoThis is a massive issue impacting us at CTM as well
- cosmolev 3y agoIs there a website/service/whatever where I can check the price of sending an SMS to a particular number?
- danielheath 3y agoYeah! Just send an SMS, then check your telco account and it'll tell you the price /s
- toast0 3y agoYour provider should have a price list. In my experience, the price lists are usually numberprefix, cost. But sometimes cost depends on actual carrier, not original carrier, so you can't know the price until a porting lookup is made, and those cost money too (those are generally a usage tiered $/lookup, starts around 0.01USD at low usage, but can go much lower if you have volume)
- jeffiel 3y agoThis article is a little dated, since then we’ve released Fraud Guard. Our model can detect and block 98% of pumping traffic with only .1% false positive. It’s working really well to deter these fraudsters. If you’re interested, you can learn more here [1]. Were also rolling out a version for all Programmable SMS customers with a higher false positive rate due to the wider variety of use cases supported. [1] https://www.twilio.com/docs/verify/preventing-toll-fraud/sms-fraud-guard https://www.twilio.com/docs/verify/preventing-toll-fraud/sms...
- rabidonrails 3y agoHey Jeff! Nice to see you're still engaged on HN!
- rsync 3y agoJeff - I use twilio as my personal telco to send and receive sms to friends and family. What kind of business entity should I incorporate to continue texting my friends? How would you define my current “campaigns” and what kind of opt-out language should I give to my children who receive my texts? Can you show me example unsubscribe language that I can give to my wife ?
- lxgr 3y agoTaking a wild guess – but is there a chance that people using Twilio as their personal phone provider are not their target customer group? Sounds a bit like opening a merchant account and using credit card payments as a way to split bills and rent with friends, and then being annoyed about being treated like a business (i.e. getting tax forms, having to declare a business model etc.) Don't get me wrong, I also use a Twilio account for my home automation setup, but I can kind of see how that's pushing the boundaries of the product a bit.
- rsync 3y ago"Taking a wild guess – but is there a chance that people using Twilio as their personal phone provider are not their target customer group?" I attended Signal 2018 and was told that (Twilio) "couldn't wait to see" what I built. I was handed IoT SIM cards and carrier SIM development kits and attended workshops and seminars exploring exactly these sort of use-cases. I was also told by many highly placed individuals in product development that the CEO was personally enthusiastic about exactly these sort of use-cases. So yes, I did some homework and made an attempt to align my incentives (I pay actual money for every SMS I send) with those of the company. Now all of that has changed - in large part due to their own (bad) behavior. "... I can kind of see how that's pushing the boundaries of the product a bit." Agreed - that is my point and the source of my frustration. Server alerts and (literal) fire alarms should not be a "campaign". If they are, I'm using the wrong tool. If I need to define an opt-out message to SMS my kids, I'm using the wrong tool. Twilio is explicitly telling us - loudly and emphatically - that they are the wrong tool. I wanted telco infra. I got toys for children.
- jwr 3y agoHere's the missing bit of advice, which you won't get, because Twilio makes money from you sending SMS messages: Do not use SMS for 2FA. Seriously — just don't. It is not secure, it is susceptible to fraud, it is not a good second factor. Yes, I do realize there are other uses for SMS, but this is the prevalent one, and I'd like people to consider seriously if they really want to use it before they blindly follow what others do. Remember that there are companies that use SMS 2FA not to make anything more secure, but to get your unique tracking identifier (your phone number) and tie it to online targeted advertising.
- tmchu 3y agoNeed to yell this as loud as possible to the goddamn banking and healthcare industry face then. Cause those dinosaurs don't even let you have an online account without an SMS (and only SMS in most case) as a 2FA mechanism. Just to shame a few out there right now: Chase, Fidelity, Bank of America, American Express, United Healthcare, Signa and many more.
- gurchik 3y agoAlly Bank used to allow 2FA through SMS or email, if I recall both were optional. But they eventually required everyone to use 2FA, and it had to be SMS -- email 2FA doesn't work anymore
- deepsun 3y agoYes, but if I lose/break my phone, I can legally resurrect my phone number. For 2FA apps I need to securely store backup keys, and take them with me when travelling. In my company we set up Duo, so at least IT Admin can bypass 2FA for me. But it doesn't work with all services, regular type-in OTP are still lost.
- kiratp 3y agoIndia has been enacting regulation enshrining SMS as 2FA for their entire Digital payments infrastructure. They even require storing all biometrics (FaceID etc.) on gov servers and not on-device. We are in for a decade+ of this at minimum.
- DEREKSUSUAN 3y agoWatch very well before you get married to that man or woman why am I saying this? I have passed through hell in the hands of men before I knew people like CRYPTORECOVERYHACKER @ GMAIL COM" exit when it comes to catching of cheating spouse. Men really dealt with me but after my contact with this hacker I realised that what ever a man tells you should be properly investigated cause most men out there are bunch of lairs am happy with CRYPTORECOVERYHACKER @ GMAIL COM" I broke into so many men cell phones to really know who they are in the hidden and trust me majority of them are lairs.