Hacker News Reader

Comment by solardev | Hacker News Reader

It kinda depends on which platform handles their bulk messages. For example, if they are messaging you through Twilio, replying with "STOP" will cause Twilio itself to opt you out of messages (https://help.twilio.com/articles/223134027-Twilio-support-fo...), and the sender can't disable that (https://help.twilio.com/articles/360034798533-Getting-Starte...). It's kinda like how Mailchimp handles unsubscriptions for recipients, no matter what the sender wants.

However, if they're using some other carrier or rolling their own VOIP setup, etc., or sending from a toll-free number instead of a shortcode, there's no guarantee that their particular platform will honor STOP. And there's no way for you, as a recipient, to know which is which.

Generally I will reply STOP if it's something I know I signed up for but no longer want. Things I never signed up for just get reported as spam and I don't reply.

View on HN

Speaking mostly for the US here.

The STOP keyword is mandated as unsubscribe at the carrier level (Verizon, ATT, TMo) not just the vendor level. So if you reply STOP, it's very likely that you will not receive another message from that number.

This will be true for any programmatic SMS vendor. There could be smaller scale & more manual approaches, but that would be rare.

There has been a big effort in the last year+ to clean up the space and require consent before any SMS is sent.

FWIW, somewhat surprisingly, my google pixel has an amazing spam filter for SMS and I rarely get SMS that I don't want.

What I want to know is, what's the purpose of those random texts that just say something like, "How's it been?" from a number that I've never communicated with? What's the angle there? Anyone know?

> What I want to know is, what's the purpose of those random texts that just say something like, "How's it been?" from a number that I've never communicated with? What's the angle there? Anyone know?

My understanding is that they will pretend it's a wrong number, but then make a joke or talk about some innocuous hobby and try to build up trust over weeks/months to eventually phish or scam you. I forget where I read it (maybe reddit?) but there was a poster who mentioned a personal experience with one such scam, basically a fake romance scam that led to them losing tens of thousands of dollars wiring money to a fake person who pretended to have fallen in love with them over weeks of back and forth texting.

It doesn't have to work on everyone to be profitable, just the once-in-a-while lonely pensioner!

https://consumer.ftc.gov/consumer-alerts/2024/05/why-its-not...

https://www.robokiller.com/blog/how-to-identify-text-scams

Thanks... that seems really labor intensive.

Labor is dirt cheap in some parts of the world, especially compared to the tens of thousands of dollars American retirees might have access to!

My deep and probably founded fear is that I’m on a list of people to scam in 40 years when I’ll be at least mildly demented.

Hopefully my efforts to waste scammers time instead of “just hang up” has got me removed from a few high-value lists.

You think scammers 40 years in the future will use a target list of phone numbers from today?

Why not? People don’t really change their phone numbers much anymore and phone numbers have become increasingly individualized.

It's done with slave labor.

It's called pig butchering. You kidnap people, hold them in Cambodia or whatever (lots of locations where local criminal gangs rule) so the locals don't bother checking for literally kidnapped slaves.

If police stop by, pay them off and make up a story about debts and punishment.

Then you use the slaves to scam others in pig butchering scams. If the slaves refuse, you beat them until they comply.

https://www.propublica.org/article/pig-butchering-scams-raid...

Thanks! That's a much better link and explanation than what I linked to.

Btw this is also used as a sob-story tactic by the scammers if you eventually call them out after some time.

Yeah a lot of it happens in office buildings in places like Nigeria. People wearing business casual clothes and everything. At first glance it just looks like a normal company.

So reply asking if they want you to notify authorities in their city. I doubt that the kidnappers are reading every message. And even if they are, better to let the kidnappers know that they are being encroached upon.

These outfits are often working under the protection of the local authorities thanks to rampant bribery.

That's why the initiative has to come from outside.

It sounds like you’ve developed a very special set of skills, Mr. Neeson.

This situation is a little more complicated than to be solved by a back and forth on the hacker news comment section.

Local authorities are involved. Sounds like the only outside initiative that will help is Seal Team 6.

According to Wikipedia it seems like China arrested a few of them. It’s a fairly big concern for them since Chinese citizens are often the victims of these foreign “business opportunities”. They will warn you if you’re going to those areas.

> These outfits are often working under the protection of the local authorities thanks to rampant bribery.

I don’t think I’ll ever visit Cambodia and I can call Cambodia for a few cents a minute as well as their embassies.

Their local authorities can’t block us all!

> I doubt that the kidnappers are reading every message.

The guy working one computer over elbow-to-elbow is gonna narc you out for better treatment, though.

Just to clarify the terminology, pig butchering refers to the scam to steal money from fake romantic partners. The SE Asian kidnapping/slavery shops that run pig butchering scams are referred to as fraud factories.

But with big payoffs.

John Oliver explained it (Pig Butchering) very well: https://youtu.be/pLPpl2ISKTg?si=yHwqzMX0r2h4mKl-

I have gotten three kinds of those:

1. Someone texting the previous owner of my number (John). I got all kinds of traffic for him, including debt collectors, friends, ex-girlfriends, employers, etc. I gather John ran into a spot of financial trouble, dropped his phone-number, and skipped town.

2. An old high-school classmate trying to find my mom found my number on one of those people search sites, probably associated with her address.

3. A random girl who just wanted to chat. I talked to her for a few messages, but didn't progress to a romance scam. She seemed real to me, but who knows?

3. is a romance scam. pig butchering/romance scams take place over multiple months, not one texting session

Could be, yeah. I'm a bit skeptical though. This took place months ago, and the conversation ended in a pretty reasonable place, something like "nice to meet you, take care" from me. I would have expected a few more engagement attempts from her if she wanted to scam me.

Well that's part of the romance scam game, you don't want to seem too needy. The best romance scammers will play a little bit of "hard to get" and a little bit of "good cop bad cop" if you know what I mean. The aloofness that you describe here was not an accident.

3. Ummm... hate to break it to you, but that's the start of the scam. Hope you don't fall deeper into that convo!

https://www.youtube.com/watch?v=pLPpl2ISKTg

It's well worth the watch, but tl;dr: it's a long-con scam. They invest as long as it takes to establish a relationship with you, and then engage you to do something (crypto mostly, apparently) involving cash online. They will say they made a bunch of money, and point you at the super-easy online exchange they used. You buy the crypto, you see the crypto increase in value (because it has in the real world) so you buy more, and more and more.

The problems start when you say you want to cash out. They switch from "buy more, it's going up" to "there are fees to withdraw, just deposit another <whatever> and then you'll get the withdrawal amount plus <whatever>" and of course no money ever comes out.

Oliver interviews people who have lost hundreds of thousands of dollars this way, some of whom still believe that if they just toss in another <whatever> it will all be resolved and they'll get their money back. It's very sad, and I'm not doing the video justice.

Tell that to Rite-Aid. These jagoffs spam the crap out of people, even after you say STOP as they instruct: https://imgur.com/gallery/if-youre-too-dumb-to-follow-own-in...

Isn’t it case sensitive? At least I always assumed it was.

For short codes in the USA, it technically does not have to be. And in fact businesses have to regularly check for requests even like "please don't send me messages" to be compliant.

> And in fact businesses have to regularly check for requests even like "please don't send me messages" to be compliant.

That's only vaguely true. The FCC has effectively said "here's a list of words that are considered reasonable opt out words and let the courts decide what is reasonable when there is a dispute." [0] They're basically deferring to the courts to determine reasonableness.

Obviously it's a good practice to remove people who are intentionally obtuse, but the courts really don't like people who don't follow the instructions, especially because sending "please don't send me messages" is more inconvenient than sending "STOP":

> The court held that “[t]he totality of the plausibly alleged facts, even when viewed in Plaintiff’s favor, militate against finding that Plaintiff’s revocation method was reasonable.” It also rejected the notion that there is something improper about prompting called parties to text “STOP,” explaining that “heeding Defendant’s opt-out instruction would not have plausibly been more burdensome on Plaintiff than sending verbose requests to terminate the messages.”

[1]

That said, it's reasonable to expect that replying "stop" regardless of case should stop those messages from coming through.

[0]: https://docs.fcc.gov/public/attachments/FCC-24-24A1.pdf

[1]: https://tcpablog.com/2017/revocation-consent-must-reasonable...

> but the courts really don't like people who don't follow the instructions

If you contact me without my consent I now have to follow your instructions to stop your harassment?

Nonsense.

No, this is specifically for the case of someone intentionally signing up to receive the texts first. Had they been unsolicited, the outcome would have been the exact opposite. The take away is don’t sign up for SMS spam, send obtuse opt out messages, and then expect a payday in court.

> No, this is specifically for the case of someone intentionally signing up to receive the texts first.

How do they know I consented vs the person who had the number prior to me? I recieve texts I didn't sign up for all the time for companies I've never heard of for people with names and addresses that are different than mine.

I really feel the burden of consent should be on the sender vs the receiver.

Think of it this way, the receiver must carefully read what they have received in order to correctly opt out but the sender can just run a regex for "STOP" and call it a day. The more difficult burden should be on the sender. They should have to validate every message received to see if it is requesting to opt out. Put another way, the consent is retracted even if your regex didn't detect it.

When it comes to sex consent doesn't work that way; "She didn't say the safeword I texted her a year ago your honor so I had consent!"

In a world where companies clamor for customer engagement, it seems absolutely fucked to me that it would seem burdensome, somehow, to monitor replies to SMS messages.

> The FCC has effectively said "here's a list of words that are considered reasonable opt out words and let the courts decide what is reasonable when there is a dispute." They're basically deferring to the courts to determine reasonableness.

Yikes. The lawyer dog comes to mind (a Fifth and Sixth Amendment Supreme Court case). Suspect speaks voluntarily to police until he realizes they suspect him of a crime. He stops and says, "I want a lawyer, dawg." What is meant to happen then is that the interrogation is stopped until that point. Police carried on the interrogation, and the Court ruled that statements he made in that period of time were admissible in securing a conviction against him.

When this was appealed, the Louisiana Supreme Court declined to hear it, saying, with a completely straight face, that there was ambiguity, and that since the police could reasonably believe that he was in fact asking for a canine lawyer, i.e. Lawyer McDog, Esquire, and that they couldn't find such an attorney, there was no invocation of counsel that warranted a termination of the interview.

Don't forget the Supreme Court ruling that your right to remain silent needs to be vocally exercised. If you just stay silent, you're not exercising your right to remain silent, you need to state out loud "I am exercising my right to remain silent." You can only exercise your right to remain silent by speaking.

Something something greatest legal minds of their generation.

Sorry for the late reply, but these are rules from the CTIA, not the FCC that I am referring to. The CTIA being an industry body for telecoms in US.

(Even later reply) Ah I see. I wasn’t familiar with the CTIA. It’s good to know that there are best practices that go beyond the FCC.

Valid question, but I've tried capitals too. Check the image now. Oddly enough, Rite-Aid changed their message to mixed case, but this time did confirm the opt-out (which was requested with "STOP").

But then they continued spamming three weeks after saying they wouldn't. Pathetic.

CVS sent me a spam today because I gave them my number to know a prescription was ready. STOP got a reply offering to only send status notifications. We'll see if it means anything to them.

Yes, can confirm about the Pixel. I occasionally check my spam folder and it's always just spam, which I otherwise never get. So either no or rarely false positives or negatives.

Also on a side note, the scams are really horrific. Although obviously scams I can imagine especially the older people getting tricked with "hello grandad here's my new number". Makes me wonder what I'll be getting tricked with when I am old.

> Makes me wonder what I'll be getting tricked with when I am old

"Hey babe, want to see my beautiful TUI? I made it in assembly."

I've been getting presidential political messages, each from a different number.

wonder if STOP will work for only the same number, or globally.

I also know political messages have lots of loopholes, thanks to the politicians who create the laws.

I replied STOP to one of these. The confirmation came from a similar, different number.

Replied to that, same deal. Did it for 20+ numbers before getting bored with it.

Aside from Pig Butchering (see other comments) this also verifies a number is real or in-use when somebody replies.

You can verify a phone number is real and active without needing them to reply, or without someone even receiving a notification.

1) SMS supports receipt functionality, which means the sender can be notified when a message is delivered to a handset. This happens at the carrier level, so you can't turn it off.

2) SMS supports 'silent' messages which are a different message class that is not shown to users.

True, however, "delivered to a device" and "there's someone reading and replying at the other end" are two different confidence levels of "active".

You could, for instance, be texting an unattended device.

Receipts are unreliable. Carriers and aggregators regularly filter or fake them.

Receiving a receipt is not a real indication of delivery, and absence of receipt is not a real indication of absence of delivery.

"What I want to know is, what's the purpose of those random texts that just say something like, "How's it been?" from a number that I've never communicated with? What's the angle there? Anyone know?"

Some people are seriously lonely - eager to pick up any chance of real interaction. And those scams prey on that.

On telegram those spam usually comes together with a profile picture of a pretty women. With text only, it targets the imagination.

Look up "pig butchering" (seriously). That is what those texts are all about. John Oliver did a whole segment on his show about it this summer.

TL;DR they are scams

https://www.youtube.com/watch?v=pLPpl2ISKTg

> There has been a big effort in the last year+ to clean up the space and require consent before any SMS is sent.

Unless it is political

Unfortunately political messages have an exception in the laws involved here.

Also, my understanding is that this isn’t even a case of the politicians making an exception for themselves but for this being protected speech, so there are legal issues with blocking it without the kind of majorities American congress is not capable of anymore.

I don't see how there could be an argument for protected speech here. The constitution protects your ability to petition the government, not the government's ability to petition you.

If someone is campaigning to be in government, I guess they don't technically fall under the "government" category yet...

And if they were running for reelection?

And neither do you. The constitution doesn’t protect your right to harass other citizens.

I don’t know if the claim is true, but if it is, it’s likely an intentional loophole because the people writing the laws would want to exempt themselves.

Yes this is what happened. There are specific carve outs for various uses that don’t fall under the legal definition of “spam.” Of course political advertising is one of them.

Just like for the longest time it wasn’t insider trading if you were a politician.

A candidate is not acting as a representative of the government. In fact, the Hatch Act generally makes it illegal to mix the two.

https://en.wikipedia.org/wiki/Hatch_Act

Which is why i just report (to Verizon) every piece of shit political spam text as junk as I delete it.

The “do not call” registry had a purpose, and it’d have been so easy to add an additional “and also no political anything” to it. Let them burn.

>What I want to know is, what's the purpose of those random texts that just say something like, "How's it been?" from a number that I've never communicated with? What's the angle there? Anyone know?

I inadvertently replied to one of those spam messages because the number coincidentally matched the location a relative had recently moved to (I figured it was them trying to joke around while informing me of their new number, it was something along the lines of "Can you guess who I am?"). They replied with a picture of a girl and some question trying to start a conversation. So, I figure they're just fishing for easily tricked or lonely people to manipulate into sending them money.

FWIW I didn't notice much of an uptick in scam texts/calls after that.

> The STOP keyword is mandated as unsubscribe at the carrier level (Verizon, ATT, TMo) not just the vendor level. So if you reply STOP, it's very likely that you will not receive another message from that number.

Is that just for programmatic messages, or all messages?

I could see problems if it was all messages. For instance suppose a relative coming to visit for weekend and due to arrive around 5 pm Friday. You get a text from them that afternoon saying that there was an accident that has blocked traffic and police say it will be several hours before the road reopens.

They ask if you would prefer that they continue as soon as the road reopens, which will probably mean they will arrive around 1 am Saturday, or stop and spend the night with another relative who lives near where they are currently stuck, and then come Saturday morning which will get them to your place around 9 am.

You text back "stop" to indicate the latter option, and now texts from that relative are blocked. Oops.

It only applies to programmatic and automated messages

When a company or service sends text messages using an automated system like SMS marketing software or bulk messaging service), these platforms are by design and mandatorily programmed to recognize keywords like "STOP" as a signal to unsubscribe the recipient from future messages. This is a requirement for all such systems under Telephone Consumer Protection Act (TCPA).

Text messages to your friends do not go through such platforms and so are not subject to that law.

It’s just programmatic vendors. The problem as someone else in the thread pointed out is that shadier carriers won’t honor it or only pay lip service to it. And people that are doing spam campaigns will be forging numbers and rotating numbers constantly so actually blocking the numbers does very little.

You need to up the swag on your online persona. I get this message from "rich horsey lady" periodically:

>I'm Alyssa. are you the equestrian instructor that Tina referred me to?

>I'm very sorry, I just checked the number and it was my assistant who sent the wrong number, I hope I'm not disturbing you.

>Thank you for understanding, you are a friendly person, I have found the right number, your number and the riding instructor's number are only one number away, haha, it was a wrong encounter, but it was a kind of fate. Let me introduce myself, my name is Alyssa Chow what is your name?

Also got it from a "Lillian." I do hope they and her assistants find Tina's equestrian instructor.

Just to screw with them, you should make a fake business website for Tina the Trainer, with that phone number listed and everything and AI photos of fake lessons with Alyssa.

Yes!

> FWIW, somewhat surprisingly, my google pixel has an amazing spam filter for SMS and I rarely get SMS that I don't want.

I still get notifications for these on my Pixel. I just don't want them.

Totally agree Only thing to add is for the U.S. its pretty easy to spin up a bunch of numbers so generally this will work only for a while. On the latter they are farming you for information Just confirming who you are is a mistake IMHO

Someone signed my work phone up for MAGA nonsense - I get urgent messages from “Marco Rubio”. They done honor stop messages.

Twilio is sort of a dream for spammers, they'll just make new accounts on it and spam campaigns on those new accounts. Political organizations do it all the time, if you get on a list you're never getting off. Lookup the numbers sending to you (Twilio's own lookup tool works great for this) and it almost always comes back Twilio/Zipwhip.

I only recommend responding STOP to short codes since there's more investment and vetting on getting a short code. Carriers will intercept the request for TFN/local numbers sometimes but I don't really trust it. These numbers are all going to be spammers buying pools of numbers to churn and burn. They'll just import their list into a new account if it unsubs.

Oh and btw, it's actually easier now as a spammer to tell when numbers get burned. A few years back when the CTIA handover on regs happened (and sending costs went up) the carriers finally started to respond with the delivery status of the sent messages. Before this they didn't respond and you only knew your provider delivered the messages to the carrier, not whether the carrier delivered them to the handset.

I think Twilio requires its customers to go through the process of registering with the CTIA before allowing use of the SMS API. I abandoned a project because the process was too burdensome. Political campaigns are exempt though.

Is that new? I tried it out for fun once and it only took a few minutes and I don't recall any major hoops.

I think it's different if you're applying for a shortcode vs a regular or toll free number though. There are different regulations governing all of those.

There's only hoops to jump through if you want higher send rates from a number. The CTIA figured out a new cash grab was registering businesses as legit senders on TFA's but it doesn't promise delivery, just gets you a nice logo/name on SMS apps.

Having been on the purchasing end for wholesale marketing SMS I can tell you most of sales people will suggest the 'correct' way and happily sell things that let you do it the 'wrong' way.

Pretty sure that’s no longer the case. You need to register your “campaign” to send any SMS messages. I put campaign in quotes because the process seems to ignore the fact that people might have use cases that are unrelated to marketing.

https://help.twilio.com/articles/1260803965530

Earlier this year I think? I have a Twilio number that I setup just so my Home Assistant system could message me about things like water leaks. They stopped delivering any of those messages (while still charging me to send them!) and I have to register as a business and provide proof I have an opt-out, etc, etc.

The only phone number I ever texted was my real cell number, it's no longer worth having a Twilio number for a hobby project.

Yes - we went through this for a client I'm currently working with. We were migrating from an approved campaign via a different provider to doing it on Twilio and even in that case, there was quite a heavy process to get approved again on Twilio.

(Which, as an end-user, I'm happy about...)

Zipwhip is particuarly bad.

I report their spam to twilio, but twilio claima they cant do anything about spam from their sub

You can check if a number is using Twilio via a special number: https://www.twilio.com/en-us/blog/lookup-phone-carrier-recor....

Or a site like https://www.freecarrierlookup.com/ which works for every number

Twilio has a concept of "hosting a number", meaning, the original carrier retains the number, only SMS is handled by Twilio. So parent's link will be more accurate for this application.

Twilio actually does allow companies to opt out of the automatic STOP handling (I've done it while working on a txt automation system).

There is a tiny bit of vetting involved and you've got to be a slightly larger account, but it is possible, so it's not safe to assume that if the message is coming from Twilio that STOP will block them at the platform level.

Worked for a company that offers marketing & transactional SMSes: our SMS provider relayed the STOPs and we were obligated to honor it, but the provider couldn't check it.

Also, the provider relayed the STOP to the last of their client that reached the number, they had no way to trace it back with 100% confidence.

Unsubscribing from one Mailchimp subscription doesn't remove you from any other subscriptions...

STOP doesn't either.

Reply on news.ycombinator.com