Validate: Is this actually fraud?

Twilio provides self-service log data to help you investigate some of the most common fraud activity patterns. Most incidents fall into one of these four categories:

• SMS Pumping: An automated AIT attack where threat actors mostly exploit your signup or OTP flows to send high volumes of messages to phone numbers they control.
• Voice Toll Fraud: Similar to SMS Pumping AIT, threat actors use your voice integration to trigger high-cost, unauthorized international calls.
• Account Takeover (ATO): A direct breach where a threat actor steals or guesses your credentials, API keys, or Auth Tokens to gain full control of your Twilio account.
• Vishing & Smishing: A threat actor uses your Twilio numbers to impersonate brands or authorities, tricking end-users into revealing sensitive data (such as usernames, passwords, credit card numbers, or other personal data).

While Twilio provides platform-level telemetry and usage signals, visibility into the business logic and intent behind your specific services, campaigns, and integrated applications is inherently limited. As a result, investigations often require combining Twilio-provided data with your organization's internal logs and context to fully understand the underlying activity.

Even if an automated attack triggers an artificial inflation of traffic on our end, it's on you to identify the root cause within your own stack. We see the traffic; you see the intent. Key activities that live outside of Twilio's direct line of sight include:

• Promotion abuse: When bots or bad actors exploit sign-up bonuses, referral credits, or marketing discounts in ways that violate the spirit of the promotion, resulting in financial loss or operational disruption for a business.
• Impersonation: Deceptive tactics where an attacker pretends to be you, a company representative, or a trusted authority to harvest data or money.
• SIM Swap Fraud: This occurs when a threat actor tricks a carrier into porting a victim's number to a new SIM.
• Bot Attacks: Fraudulent activities carried out by automated software programs ("bots") that mimic human behavior to exploit, abuse, or defraud online systems and services.

Fraud-related activity on your Twilio account can occur with or without an Account Takeover (ATO).

In some cases, a threat actor does not need to compromise your account to cause harm. For example, SMS pumping can occur without an ATO. However, when an ATO does occur, the impact can be more severe. With access to credentials such as passwords, Auth Tokens, or API keys, a threat actor may be able to bypass existing security protocols, including rate limiting or CAPTCHA protections.

In ATO scenarios, attackers can also leverage your account's established reputation. For example, phone numbers you own may be used as senders for fraudulent traffic, increasing both customer impact and financial exposure.

In Twilio terms, fraud generally falls into one of two categories:

Designed to steal money directly from you by exploiting your Twilio account and its balance. You are the primary victim, and the threat actor's goal is to get a share of the generated revenue while sticking you with the bill.

Happens after your account has been compromised. The threat actor's goal is to use your account's resources and reputation as a weapon to attack other people and/or drive up your bill, bypassing whatever front-door security controls you may have in place.

Even when fraud appears to occur without account compromise, always evaluate for indicators of ATO as part of your investigation.

If you are unsure whether you're experiencing fraud, there are several behaviors your organization can check to validate potential abuse. The three most common indicators Twilio sees across customer investigations include:

Look for sudden, unexpected increases in your Twilio usage or billing. These spikes may appear as sharp increases in voice call minutes, SMS messages sent, or Verify API requests. As part of your validation process, review both billing data and correlated usage metrics to determine whether the increase aligns with legitimate activity or indicates potential fraud.

If you suspect a billing spike has occurred in the past 30 days:

1. Log into the Twilio Console and navigate to Monitor > Insights > Billing Usage.
2. Check for spending spikes by service. Spend is broken down by SMS, Voice, and overall spend.

Due to the possibility of delayed billing, we recommend customers investigate spikes in usage as well:

1. For call volume over time, navigate to Monitor > Insights > Voice > Calls.
2. For incoming and outgoing message volumes over time, navigate to Monitor > Insights > Messages.
3. (Optional) If SMS Pumping Protection is enabled, go to Monitor > Insights > Messaging Intelligence to view AI-powered alerts for anomalies such as SMS pumping based on your historical usage trends.

Note: To increase the time range for voice call volume insights, upgrade to Voice Insights Advanced.

Messages or calls sent to countries where you don't normally conduct business is another common indicator of fraud. In many cases, threat actors will target high-cost or premium-rate numbers associated with specific international locations to maximize financial impact.

In addition to traffic patterns, review Twilio Console and API activity for access originating from the same unexpected or high-risk locations. Correlated anomalies across traffic, usage, and account activity may indicate account compromise or coordinated abuse.

To see an overview of the volume of messages by country:

1. Log into the Twilio Console and navigate to Monitor > Insights > Messages.
2. Click on the Delivery & Errors tab.
3. Set the breakdown to Total Messages.
4. For message direction, you will most likely want to have Outgoing selected to look for SMS pumping.
5. Scroll down to the section titled Outgoing Messages by Top 20 Destination Countries. Look for high volume from any countries that look suspicious.
6. If you are using Twilio Verify and Verify Fraud Guard, navigate to Monitor > Insights > Verify > Fraud.
7. The Verify SMS Fraud Insights dashboard will show you fraud that was detected by Fraud Guard and provide easy-to-digest visualizations on country and performance trends such as conversion rates.

To see an overview of the volume of voice calls by countries not common to your business:

1. Log into the Twilio Console and navigate to Monitor > Insights > Voice > Calls.
2. (Optional) If you have Voice Insights Advanced, select the appropriate time range for the suspected events by clicking Time range.
3. Select More filters.
4. Under To phone number attributes, click on the dropdown under To country code. Select all country codes associated with countries that are not historically business relevant.
5. Under Calls, observe if there is a significant increase in total calls over time. In addition, check Average length of call (ALOC), as consistently short calls can also indicate fraud.
6. (Optional) If you are supporting a Twilio Verify Voice channel service, navigate to Monitor > Logs > Verify. Sort by Country and Date/time range.

To see an overview of API or Console activity from a specific IP address and perform a geo lookup:

1. Log into the Twilio Console and navigate to Monitor > Insights > Audit.
2. Click Audit Events Log.
3. Under Source IP, check for administrative activity, including new user session creation, from unrecognized IP addresses.
4. To check the country of origin for a suspicious IP address, use a free lookup service such as those that can be found at ipinfo.io.

The following administrative actions are high-risk indicators of ATO and should be treated as suspicious unless explicitly authorized:

• Creation of new API keys
• Modifications to geo-blocking rules
• Changes to account-level settings

If any of these actions are unexpected, they may indicate account compromise. Use the steps below to review recent administrative activity and validate whether the changes were legitimate:

1. Log into the Twilio Console and navigate to Monitor > Insights > Audit.
2. Click Audit Events Log.
3. Under Event Type, high-risk administrative events should be evaluated by your organization for legitimacy, such as account-api-keys.created, account-api-keys.updated, voice-geographic-permissions.updated, and application.created.

Once you have confirmed that fraudulent activity is occurring, identify the specific fraud type involved so you can take the appropriate containment and remediation actions. The sections below outline common fraud patterns and the key indicators to use when narrowing down the type of abuse you may be experiencing.

This category includes direct abuse of the Twilio platform. Because this activity occurs within Twilio systems, Twilio may be able to provide logs and telemetry that offer more direct visibility to support your investigation.

The following activities are often associated with AIT and vishing/smishing. While Twilio provides some native tools to support detection, investigations in these cases will primarily rely on your organization's internal logs for user identity, authentication, and engagement activity.

Because Twilio has limited visibility into customer-integrated systems, your internal monitoring and telemetry will be the primary sources of truth when validating these threats.

If you have confirmed ATO involvement or other types of fraud and abuse, we recommend that you immediately take steps to eliminate any remaining paths for access and further abuse by proceeding with the actions outlined in the Contain phase.

If you require additional assistance from Twilio Support, either to perform administrative actions or to support the investigation, proceed to the Engage phase.