I highly doubt Twilio knowingly allows this to happen. Furthermore, if anyone linked their card with Twilio, it would not have been hard to track down who is doing this and freeze their assets (from a fed agency perspective) or at least block their account (from Twilio's mod team perspective).

I've been a Twilio customer for a long time. They don't allow you to spoof caller ID. You can only set outgoing caller ID to a real number that you own or have access to.

I've always been curious how much of this happens through companies like Twilio. Are there any numbers / studies out there that dig into it?