pettycashstash2

I manage VoIP infrastructure for several organizations using Flowroute and 3CX. Real businesses, real clients, real dependency on uptime. A few weeks ago Flowroute killed my account. My balance went negative. A billing email hit my spam folder and I missed it. I am human. Apparently that is disqualifying.

The Verification Rather than call me on the business phone number they had on file, a phone company calling the phone, they demanded identity verification through Persona. I submitted a government ID, a facial biometric scan, and LLC documents. Persona verified everything. Flowroute still said no.

The Email

"Thank you for completing the Persona verification process. After a thorough review, we regret to inform you that the verification was not approved. For security and compliance reasons, we are unable to disclose the specific details regarding the outcome."

I cannot appeal a reason I am not allowed to know. I cannot correct a mistake that will never be named. When I raised business continuity concerns for the other organizations I support, the response was: you should probably cancel those other accounts too. A phone company told me to cancel my customers' phone numbers.

The Upsell Instead of an escalation path I got this:

"Channel plan starts at $24.95 per channel. Minute package starts at $50 for 2500 minutes. I personally find the SIPTRUNK portal easier than Flowroute to navigate. I'm free tomorrow at 4:00pm, Wednesday after 2:00pm, or Thursday 1:00pm to 3:00pm EST."

Same conversation. Calendar invite included. Too unverified to keep my existing account. Verified enough to open a new more expensive one by Thursday.

The Kicker

"If you wish to proceed with cancelling your other accounts, please provide the tech prefix and the email address associated with the account so we can properly authenticate the request."

To stay: government ID, face scan, LLC documents. Insufficient. To leave: tech prefix and email. Done. My face was not enough to keep my account. My email was enough to close it.

The Connection SIPTrunk is owned by BCM One. Flowroute is owned by BCM One. The company that disabled my account, rejected my verified identity, and dismissed my business continuity concerns also owns the premium product their agent just pitched me. I am not alleging conspiracy. I am describing an outcome where BCM One wins either way.

The Persona Problem Persona is not a simple identity tool. It is a full KYC and AML compliance platform that reportedly runs nearly 270 individual checks including screening against categories ranging from financial crime to national security flags. I submitted my face to verify a VoIP account and apparently entered a compliance screening architecture nobody explained, with criteria nobody will share and results nobody will discuss. That is not verification. That is a black box with consequences and no appeal.

The Lesson Only my number was affected. My clients were fine because every organization I support has its own separate account, their own numbers, their own credentials. That decision paid for itself this week. If you run VoIP for multiple clients under one master account, one billing hiccup or one opaque algorithm takes everyone down at once. Keep accounts separate. Run dual trunks from different providers. Your clients own their assets. Make sure the structure reflects that.

Has anyone else hit this with BCM One? Has anyone found a path through the Persona black box? If anyone from Flowroute or BCM One management is reading this, my contact information is in my profile. The door is open.

I'm at my wit's end with contact form spam on my sites. I've tried:

CleanTalk - caught some spam but still getting through, plus the monthly cost adds up Turnstile - better UX than reCAPTCHA but bots seem to be solving it reCAPTCHA v2 - effective but users hate the image challenges reCAPTCHA v3 - invisible but I'm still getting 20-30 spam submissions daily even with strict thresholds

I've also implemented honeypots, rate limiting, basic keyword filtering, and email validation (both format checking and MX record verification). The spam is getting more sophisticated - proper English, realistic email addresses that actually exist, even passing behavioral checks. What I'm curious about: How does Hacker News handle spam so effectively? I rarely see spam comments here, and there's no visible CAPTCHA. Are you using something custom, or is there a service/approach I'm missing? For context, I get about 500 legitimate form submissions per month, so I need something that won't block real users while stopping the bot flood. What's worked best for your sites? Especially interested in hearing from anyone who's dealt with determined, human-like spam at scale.