SMS pumping, also called toll fraud in the verification world, works because sending a text is not free and receiving one can pay. An attacker finds a public form that sends one time passcodes, a signup, a login, a password reset, and scripts requests to large blocks of numbers in high cost destinations. Somewhere in the routing chain, a local operator or aggregator sharing revenue with the number holder takes a cut of the termination fees for each message delivered. The victim company pays its messaging provider for thousands of codes nobody requested, to numbers nobody will ever type in. Bills arrive monthly, so a pumping run over a holiday weekend can reach five figures before anyone reads an invoice. Twilio, Vonage, and the other large verification providers document the pattern and ship fraud controls for it precisely because it is industrial now, not exotic. The vulnerability is not the OTP itself. It is an unauthenticated public form that spends money on every submission, guarded by nothing.
The economics point one way
Legitimate verification traffic has a shape: numbers spread across the countries the product actually serves, requests tied to sessions doing other human things, a healthy share of codes entered and accounts created. Pumping inverts the shape. One country the product barely serves suddenly dominates sends, conversion from send to verified collapses toward zero, and requests arrive at machine regular intervals from thin infrastructure. Providers expose these signals, country level send and conversion rates, because the victim cannot see the fraud in any individual message. Every single text looks like a text. The fraud exists only in aggregate, which is why the invoice, not the log line, is so often the detection system.
Number intelligence helps at the margin: line type and carrier checks can flag ranges associated with revenue share schemes, and blocking premium rate and non geographic ranges in destinations you do not serve removes whole categories of payout. But the core control is economic, make the form stop spending freely.
Related reading on this site: Home and Email Validation Has Three Jobs. Most Forms Only Do the First. cover the neighbouring problems in more depth.
Cap the spend before you tune the detection
Geography allow lists are the blunt, effective first move: if the product does not serve a country, its numbers cannot receive codes, and the highest cost destinations should be opt in per business case, not open by default. Velocity limits per IP, per device, per number, and per country per hour convert an unbounded liability into a bounded one, and a global daily spend ceiling with alerts at fractions of it turns a five figure surprise into a phone call at the first fraction. Providers support geo permissions and rate controls natively in current verification APIs, which means leaving them off is a choice, usually an unmade one.
A CAPTCHA or equivalent bot check before the send button changes the attacker's unit cost from near zero to the price of solving challenges at scale. It will not stop a determined operation. It stops the casual script, which is most of the volume, and it slows the rest enough for velocity controls to see them.
Voice fallback and quiet forms widen the hole
Audit every surface that can trigger a message, not just the main signup. Voice call delivery of codes costs more per attempt than SMS and is often left outside the controls placed on texts. Password reset, phone change, and two factor enrollment forms each spend the same money with different owners inside the company, and pumping crews enumerate forms the way they enumerate number ranges. One inventory, one set of limits, one bill owner who reads the aggregate dashboard weekly: that is the whole programme, and it is cheaper than one good weekend of someone else's revenue share.
Frequently asked questions
What is SMS pumping fraud?
It is a scheme where attackers use a public form that sends one time passcodes to request codes to large numbers of phone numbers in high cost destinations. Intermediaries in the delivery chain share the termination revenue, while the company whose form was abused pays the messaging bill.
How can a company tell it is being pumped?
By aggregate signals: a sudden concentration of sends to a country the product barely serves, conversion from code sent to code verified collapsing, machine regular request timing, and a messaging bill spike. Individual messages look normal, so monitoring has to be at country and conversion level.
What controls stop SMS pumping?
Geography allow lists limited to served countries, velocity limits per IP, device, number, and destination, daily spend ceilings with alerts, bot checks before the send action, and blocking premium or non geographic number ranges in unserved destinations. Verification providers expose these as native settings.
Why is voice OTP delivery a separate risk?
Voice delivery of codes usually costs more per attempt than SMS and is sometimes configured outside the rate and geography controls applied to texts. Attackers look for the least controlled surface that spends money, so every form and channel that can trigger a message needs the same limits.