Hacker News Reader

Comment by PragmaticPulp | Hacker News Reader

I can believe fraud was happening.

I have a harder time believing that 390 different telcos were all running the same fraud to the tune of $60 million per year and none of the previous Twitter administration thought to check into it.

This feels like another one of those claims that has a kernel of truth, but gets exaggerated for dramatic effect as a PR move. Like those drug busts that find a small amount of drugs, but then use the entire weight of the container it was found in multiplied by the highest possible street value they can imagine so they can claim a gigantic number in the headlines.

View on HN

My brother, I encountered the 1800 free conference call guy and very specifically he said that the industry for both calls and texts like this is huge. At the time he was using that info to attempt to prevent a major merger that eventually went through - but his direct account of the mechanics makes Elons claim more than probable and well beyond credible; basic fact without the individual logs.

Factoid: Every call makes money for the sender no matter if you pick it up or not. Every text the same; especially hiding in plain sight of SMS 2FA

You mean makes money for the receiving telecom?

The way I remember it, in the US there are rural telcos that can't afford to maintain infrastructure out the revenue they pull on sparse populations, but the government believes it's critical that citizens have telephone access anyway.

So when a call is placed inbound to telcos of a certain class (size, revenue, I'm not sure), the destination telco receives a fee / subsidy (I think from the telco originating the call).

People figured out that they could run free conference call services hosted on rural telco phone numbers, bringing in oodles of calls, then collect a cut of the subsidy.

And people get upset when their cell carriers charge them $1/minute to cover the additional fees when they call these numbers. smh

I think Elon was suggesting that Telcos were turning a blind eye to the fraud that was damaging twitter, not that they were committing it directly.

I think this is actually the first sensible thing Elon has done since the takeover

> Basically, there are telcos who are not being super honest out there, in other parts of the world, who were basically gaming the system and running, like, two-factor authentication SMS texts over and over again, and just creating a zillion bot accounts to literally run up the tab so that Twitter would SMS text them, and Twitter would pay them millions of dollars, without even asking about it.

He’s very clearly accusing the telcos themselves of creating bot accounts.

I don't exactly see the issue with telcos being accused. Telcos still have done almost nothing to address scammers, fraudulent texts and we all know it is because the benefit financially from their services being abused.

True, his messaging wasn't consistent. He is calling them fraudsters (and suggesting some of them are doing it directly). Some of the fraud may be indirect though:

> Listen, if you stop scamming us, then we will gladly pay you some amount of money for SMS texts but you can’t turn a blind eye to relentless bogus SMS texts

The suggestion here is that the telcos are complicit in the fraud, but "blind eye" suggests they may not be directly responsible.

Hmm, I interpreted the "you" to mean the general "you", not telcos; basically meaning that Twitter can't just turn a blind eye. Similar to how some might say: "I elected to the gym today; you can't just sit on the couch all day after all".

That would certainly be a bit awkward wording though, using "you" to refer to both the telcos and to Twitter/the general "you" in the same sentence.

It's unclear if "you" is telcos or Twitter in the last part.

Or depends if the fees were for SMS fees to the telco (!?) or fraudulent "pay-to-send-to SMS numbers" ("1-900" numbers), a massive scam that shouldn't exist at all.

Would you say that a telco is complicit in fraud if it offers a negative rate to customers who take their inbound calls/SMSes in the building where the telco receives the calls/SMSes from its peers/upstream?

Addressing the issue is sensible, and yet he found the least sensible way to do it. Putting the onus on the user to remove sms two factor and making worse security a paid feature is just absurd.

It's not clear to me if Twitter offers other types of 2FA like TOTP. I don't use it.

What do you think the solution is here though? If someone is using a company that's scamming twitter, it's not their responsibility to continue being scammed so they can support SMS 2FA for that user.

A reasonable solution would be to disable the ability to add SMS 2FA to accounts and require either disabling 2FA or selecting a different 2FA method upon next login. If specific accounts with SMS 2FA manage to abuse it after that then ban those accounts, since you can't add SMS 2FA to a new account that removes their avenue for abuse.

They do, thankfully, support TOTP and U2F keys (and multiple of them).

Twitter doesn't deserve to be help hostage by users using a fraudulent Telco.

Considering how many spam calls come to my phone on a hourly basis, I’m inclined to believe Elon when he says some telcos aren’t in it for the enjoyable user experience.

Given the IRSF attacks that I’ve seen the number isn’t out-of-line with reality. Many of the attacks originate from countries that are perennially short hard currency and with sanctions and rising interest rates dollars are hard to come by. As a head of a telco that needs hard cash to pay for equipment that is all imported, how closely are you going to look?

Yea this is my take as well, having worked in this space. You can and will lose millions without detection, but 60M seems extremely rich, even for a VC-funded growth stock giant like twitter.

Reply on news.ycombinator.com