Loading post…
TwilioDan Nieters, Rohit Agarwal, Alena EissmanAnnouncement
September 2026 Fraud Update: Phishing Trends, Third-party Safety and Latest Releases
Summary
Twilio’s Q3 2026 fraud update covers phishing trends, third-party safety, and new releases. Over 80% of phishing originating from SendGrid was due to account takeovers, with attacks centered on delivery service spoofing, invoice fraud, and targeted Japanese campaigns impersonating brands like Amazon and Mercari. Attackers used fabricated forwarded threads, typosquatted domains like tvvilio[.]org, familiar names, AI-generated email templates, and associated phone calls, sometimes spoofing Twilio’s help line. To secure third-party integrations, Twilio recommends scoping access strictly, practicing credential hygiene, and reviewing audit integrations regularly, and now recommends OAuth 2.0 Client Credentials over auth tokens or API keys for scoped short-lived tokens. New releases include IP ACL with Dry Run mode, which logs blocked requests without enforcement to prevent accidental lockouts before real enforcement.
Context
Twilio’s quarterly fraud update for Q3 2026, covering phishing trends, third-party safety, and new releases.
Takeaways
Over 80% of phishing originating from SendGrid in Q3 was due to account takeovers.
Attackers used fabricated forwarded threads, typosquatted domains, familiar names, AI-generated email templates, and associated phone calls to impersonate trusted entities.
Twilio now recommends OAuth 2.0 Client Credentials over auth tokens or API keys for scoped, short-lived access tokens.
FAQ
What phishing tactics did attackers use in Q3 2026?
Attackers used fabricated forwarded threads, typosquatted domains like tvvilio[.]org, familiar names, AI-generated email templates, and associated phone calls, sometimes spoofing Twilio's help line.
How can I secure third-party integrations with Twilio?
Scope access strictly by using restricted API keys, practice credential hygiene with regular rotation, review audit integrations regularly, and adopt OAuth 2.0 Client Credentials for scoped short-lived tokens.
What is IP ACL Dry Run mode?
IP ACL Dry Run mode lets customers validate their IP allowlist before enforcement. It logs which requests would be blocked without actually blocking them, preventing accidental lockouts.
Source and freshness
- Source
- twilio.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.