---
title: "September 2026 Fraud Update: Phishing Trends, Third-party Safety and Latest Releases"
description: "Twilio’s Q3 2026 fraud update covers phishing trends, third-party safety, and new releases. Over 80% of phishing originating from SendGrid was due to account takeovers, with attacks centered on delivery service spoofing, invoice fraud, and targeted Japanese campaigns impersonating brands like Amazon and Mercari. Attackers used fabricated forwarded threads, typosquatted domains like tvvilio[.]org, familiar names, AI-generated email templates, and associated phone calls, sometimes spoofing Twilio’s help line. To secure third-party integrations, Twilio recommends scoping access strictly, practicing credential hygiene, and reviewing audit integrations regularly, and now recommends OAuth 2.0 Client Credentials over auth tokens or API keys for scoped short-lived tokens. New releases include IP ACL with Dry Run mode, which logs blocked requests without enforcement to prevent accidental lockouts before real enforcement."
---

# September 2026 Fraud Update: Phishing Trends, Third-party Safety and Latest Releases

[Twilio](https://yomu.fyi/company/twilio) · Dan Nieters, Rohit Agarwal, Alena Eissman · Oct 8, 2026

**Type:** Announcement

## Summary

Twilio’s Q3 2026 fraud update covers phishing trends, third-party safety, and new releases. Over 80% of phishing originating from SendGrid was due to account takeovers, with attacks centered on delivery service spoofing, invoice fraud, and targeted Japanese campaigns impersonating brands like Amazon and Mercari. Attackers used fabricated forwarded threads, typosquatted domains like tvvilio\[.\]org, familiar names, AI-generated email templates, and associated phone calls, sometimes spoofing Twilio’s help line. To secure third-party integrations, Twilio recommends scoping access strictly, practicing credential hygiene, and reviewing audit integrations regularly, and now recommends OAuth 2.0 Client Credentials over auth tokens or API keys for scoped short-lived tokens. New releases include IP ACL with Dry Run mode, which logs blocked requests without enforcement to prevent accidental lockouts before real enforcement.

## Context

Twilio’s quarterly fraud update for Q3 2026, covering phishing trends, third-party safety, and new releases.

## Takeaways

- Over 80% of phishing originating from SendGrid in Q3 was due to account takeovers.
- Attackers used fabricated forwarded threads, typosquatted domains, familiar names, AI-generated email templates, and associated phone calls to impersonate trusted entities.
- Twilio now recommends OAuth 2.0 Client Credentials over auth tokens or API keys for scoped, short-lived access tokens.

## FAQ

### What phishing tactics did attackers use in Q3 2026?

Attackers used fabricated forwarded threads, typosquatted domains like tvvilio\[.\]org, familiar names, AI-generated email templates, and associated phone calls, sometimes spoofing Twilio's help line.

### How can I secure third-party integrations with Twilio?

Scope access strictly by using restricted API keys, practice credential hygiene with regular rotation, review audit integrations regularly, and adopt OAuth 2.0 Client Credentials for scoped short-lived tokens.

### What is IP ACL Dry Run mode?

IP ACL Dry Run mode lets customers validate their IP allowlist before enforcement. It logs which requests would be blocked without actually blocking them, preventing accidental lockouts.

**Tags:** [Fraud](https://yomu.fyi/topic/fraud), [OAuth2](https://yomu.fyi/topic/oauth2), [Phishing](https://yomu.fyi/topic/phishing), [Security](https://yomu.fyi/topic/security), [Twilio](https://yomu.fyi/topic/twilio)

- Source: [Twilio](https://www.twilio.com/en-us/blog/insights/best-practices/quarterly-fraud-update-sept-2026)
- Source URL: https://www.twilio.com/en-us/blog/insights/best-practices/quarterly-fraud-update-sept-2026
- Ingested by Yomu: 2026-10-09T06:00:29.850Z

[Read original post](https://www.twilio.com/en-us/blog/insights/best-practices/quarterly-fraud-update-sept-2026)