Every hour

Catch an unusual jump in Twilio spend

If today's texts or calls cost far more than usual, you're alerted with a breakdown, which can be an early sign of fraud.

Runs: Every hour
Apps: Twilio
AI: Not needed
Access: read

Send this to your assistant

Create a ClickRuntime automation: every hour, compare today's Twilio usage with my 7-day daily average and email me a breakdown by category if it's more than 3 times higher.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

Toll pumping and compromised credentials can turn a small Twilio bill into a large one in a single afternoon. An attacker triggers thousands of verification texts to premium-rate numbers through a public sign-up form, or a script gets stuck in a loop. A startup with a normal daily spend of thirty dollars can burn through a month's budget overnight and only find out on the invoice.

Every hour, this reads today's usage records from Twilio, compares spend and message or call volume with the average of the previous seven days stored from earlier runs, and alerts you with a breakdown by category when today is far above normal. You see the problem the same day, with a clue to where it comes from.

Teams with public sign-up forms or phone verification should consider it essential.

What you get out of it

Fraud is caught in hours, not weeks
An hourly comparison spots a sudden jump in verification texts soon after it starts. You can disable the form or block the destination the same day, before a large bill piles up.
The breakdown points to the source
The alert includes usage by category, such as SMS, voice or verification. Knowing that outbound SMS tripled narrows the search for the cause and tells you where to look first.
Compared with your own normal
Alerts are based on the average of the previous seven days, not a fixed number. A business that grows steadily is not bothered, while a sudden multiple of normal triggers a warning.
Protects against bugs, not only attacks
A retry loop that sends the same text over and over looks like a spike too. The alert catches honest mistakes in your own code before they turn into expensive ones.
Gives finance a defensible record
If you need to dispute charges with Twilio, a time-stamped alert with figures shows when the unusual usage began. That strengthens your case and supports requests for a review of fraudulent traffic.

How it works

What happens, step by step

Every hour, ClickRuntime reads what your Twilio account has spent today.
It compares that with your usual daily spend over the last week.
If today is more than three times the usual, you get an email with the total and a breakdown by texts and calls, which can be an early sign of fraud. You get at most one alert a day.

Before it runs live

Connect Twilio

What you get

RunsEvery hour

Catch an unusual jump in Twilio spendtoday, 9:00Succeeded

Email · Unusual Twilio usage todaySpent 182.40 today vs about 11.20/day. sms: 176.90 calls: 5.50

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Twilio steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

unusual_usage_spike_alert.pyexample

from clickruntime import on_trigger, credentials, http, state, notify

@on_trigger
def run(event):
    sid = credentials.secret("TWILIO_ACCOUNT_SID")
    base, auth = f"https://api.twilio.com/2010-04-01/Accounts/{sid}/Usage/Records", (sid, credentials.secret("TWILIO_AUTH_TOKEN"))
    today = {r["category"]: float(r["price"] or 0) for r in http.get(f"{base}/Today.json", auth=auth).json()["usage_records"]
             if r["category"] in ("sms", "calls")}
    week = http.get(f"{base}/LastMonth.json", auth=auth, params={"Category": "totalprice"}).json()["usage_records"]
    avg = float(week[0]["price"]) / 30 if week else 0
    total = sum(today.values())
    if avg and total > avg * 3 and state.get("alerted_on") != event.get("scheduled_time", "")[:10]:
        notify.email_me("Unusual Twilio usage today",
                        f"Spent {total:.2f} today vs about {avg:.2f}/day.\n" + "\n".join(f"{k}: {v:.2f}" for k, v in today.items()))
        state.set("alerted_on", event.get("scheduled_time", "")[:10])
    return {"today": total, "daily_average": round(avg, 2)}

FAQ

Common questions

How does it decide what is far above normal?

It compares today's usage so far with the stored seven-day average, using a multiplier you pick, such as two times normal. Because it compares with an average of full days, early in the day you may want a minimum spend before alerting.

What is toll pumping?

It is a fraud where attackers trigger many messages or calls to numbers that earn them a share of the fees. Public forms that send verification texts are common targets, so rate limiting and country restrictions help too.

Does the alert stop the spending?

No. It tells you so you can act, for example by pausing the sign-up form or setting geographic permissions in Twilio. Automatic shutoffs risk blocking real customers, so a person makes that call. Twilio's own geographic permissions are the usual next step.

What permissions does it need?

read. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (every hour). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Every 5 minutes to every 6 hours