Twitter Suspends Large Network of Fake Accounts

[engine]

Twitter has suspended a large network of fake accounts that were abusing twitter's API to find user accounts associated with phone numbers.

After our investigation, we immediately made a number of changes to this endpoint so that it could no longer return specific account names in response to queries. Additionally, we suspended any account we believe to have been exploiting this endpoint.

Users without a phone number, or have disabled the option to let people find you by searching for a phone number, were not impacted.

It's not specific about the "large numbers" in the network, but, clearly, these bad actors are looking for ways to abuse the API, and, may end up spoiling it for those that use it for legitimate reasons.

If you haven't already, i'd want to turn off the phone number search.

[privacy.twitter.com...]

[blend27]

Would the logic behind this API feature be like: I know this person`s phone number but also must know what the person twitting about? Why not just call and ask for t-handle and maybe say Hello at the same time?

...we immediately made a number of changes to this endpoint so that it could no longer return specific account names in response to queries...

...is that only for those who don't want to pay for it?

[Lexur]

I have some Twitter accounts following zero users and from time to time a followed user pops from nowhere.
.
I've seen a decrease in the number of fake followers appeared in these accounts in recent times, so I suppose someone into Twitter is doing something against fraudsters.

[engine]

@blend27 in the very worst case they are scammers looking for private information, potentially, for identity theft.

@Lexur, i see many fake accounts, not just on twitter. Facebook is rife with fake accounts, too.

[brotherhood of LAN]

FB has always seemed slightly better in these occasions, at least wrt "bulk uploading of contacts", as the data they return isn't linked to any account and you're expected to select people based on their picture/plaintext name.

Them and linkedin would rate limit how many times you could upload/search for people this way, Twitter never used to.

I know in the past it was possible to abuse Twitter using bulk uploads in a less than obvious way. You could upload 300 contacts and get a bunch of twitter ids back, not knowing which email correlates to which twitter id - then take one from each batch and add to the next bath, after 300 iterations you're getting match ups for a full 300. That was about 5 years ago so perhaps they've tightened it up a bit.

Having a few hundred accounts and just churning through an email/phone list it's not hard to see how you could map them on-scale, which of course is a bit of a joke for privacy but as their post mentions, "handy" for getting new users on board free and quick.