# How I Could Steal Money from Instagram, Google and Microsoft

Instagram, Google, and Microsoft robocall/2FA endpoints accepted premium-rate phone numbers, letting attackers trigger paid calls and siphon carrier revenue.

- Payout: $2,000
- Severity: medium
- Program: Google, Microsoft, Meta / Facebook
- Credited: Arne Swinnen
- Disclosed: 2016-07-15
- Write-up quality: 7/10
- Original: https://www.arneswinnen.net/2016/07/how-i-could-steal-money-from-instagram-google-and-microsoft/
- Library page: https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft
- Tags: domain:web impact:funds-loss kind:bounty platform:blog sev:medium tech:payment technique:param-pollution vuln:business-logic

**Target:** Phone verification robocall / 2FA call endpoints
**Root cause:** Services placed outbound calls to any supplied phone number without validating it was non-premium, and rate limits were per-account rather than per-destination number.
**Steps:**
1. Register a premium-rate number (e.g. 0.06 GBP/min UK via eurocall24.com) with SIP forwarding.
2. Instagram: POST to `https://i.instagram.com/api/v1/accounts/robocall_user/` with the premium number; replay every 30s via Burp Intruder.
3. Google: enroll premium number as 2FA phone, then trigger login calls (10/hour) via Selenium loop every 6 min.
4. Microsoft: submit premium number at Office 365 trial registration; bypass 7-attempt block by prepending up to 18 zeroes (or country code 48) and appending up to 4 random digits, yielding 172*11111 variations.
5. Run concurrent calls (2*10) to exceed per-source concurrency limits.
**How found:** Noticed the robocall/2FA feature dials arbitrary user-supplied numbers; tested a premium number and observed calls succeeded, then probed rate-limit and blocking behavior with padding and appended digits.
**Exploitation:** Attacker registers premium-rate numbers, links them to accounts, and automates call triggers so the victim company pays premium termination fees to the attacker's carrier, extracting revenue per call duration.
**Escalation:** Scaling via many [account, premium number] pairs (100x) and, for Microsoft, number-variation bypasses yielding ~13.3M calls per premium number plus concurrent calls.
**Insight:** Any feature that dials or messages user-supplied phone numbers is a toll-fraud surface: test premium-rate numbers and probe whether blocking/rate limits key on the exact string (padding, country-code substitution, trailing digits) or the account rather than the destination.