SMS pumping, also called artificially inflated traffic (AIT), is when bots trigger large numbers of SMS from a business's own sign-up, login or OTP forms to numbers whose termination revenue is shared with the fraudster. The business pays for messages nobody wanted; the defence is to watch verification conversion rates, limit sends per number, country and IP, and only open the countries you serve.
How it works, in short
Any form that sends an SMS when a user types a phone number can be abused. Automated scripts submit thousands of numbers, often in ranges of a few countries and often in sequence. Each message is real and billable. Somewhere in the delivery chain, a party that controls those numbers or the last hop earns a share of the termination fee. Unlike a hacked account, nothing looks broken: your system is simply doing what it was built to do, many thousands of times. The two sides of business messaging are explained in A2P vs P2P SMS.
Warning signs
| Sign | What you see |
|---|---|
| Low conversion | Many OTPs sent, few codes entered; the clearest signal |
| Unexpected countries | Sudden volume to countries where you have few or no users |
| Sequential numbers | Requests for numbers differing only in the last digits |
| Spikes at odd hours | Bursts outside your users' normal activity |
| Repeated requests | The same number or IP asking for many codes in minutes |
| Odd delivery statistics | Very high or very low delivery rates on new destinations |
The conversion rate is the key metric: codes verified divided by codes sent, per country and per hour. If your normal rate for a country is 70% and it drops to 10% with volume rising, stop and look. Delivery statistics help too, see SMS delivery rate and latency.
Prevention on your forms
- Country allow list: send SMS only to countries where you have customers. Add others when needed.
- Rate limits: per phone number, per IP, per device and per session, with increasing wait times between resends.
- Bot protection: a challenge or invisible bot detection on forms that send SMS, especially sign-up and password reset.
- Number checks: validate the format, reject premium and unassigned ranges, and consider an HLR lookup for high risk countries.
- Send only after a step: require an email or another signal before the SMS is sent.
- Spend caps: daily or hourly limits per country, with alerts before the cap is hit.
- Alternative channels: for some users, another verification channel removes the incentive, see OTP fallback options.
More on secure OTP flows in OTP SMS best practices.
What to ask your SMS provider
- Does the provider offer country controls, spend limits and alerts on your account?
- Does it monitor for AIT patterns across customers and block known abused ranges?
- What happens with charges for traffic confirmed as AIT? Terms differ widely; get the answer in writing before you sign.
- Which route types are used for each country? Pumping often exploits long, opaque chains; see grey SMS routes.
If it is already happening
- Block or pause SMS to the affected countries or ranges.
- Tighten rate limits and turn on bot protection on the abused form.
- Export the logs (numbers, IPs, times) and send them to your provider.
- Review every SMS triggering endpoint, not only the one attacked first.
VoIPMatcher sources A2P SMS routes from its carriers for the countries you specify, which keeps your exposure limited to the destinations you use. Request an SMS route.
Frequently asked questions
Who pays for SMS pumping?
In most cases the business whose form sent the messages pays, because each message was requested through its account and delivered as normal traffic. Some providers offer protection features or credits for confirmed artificially inflated traffic, but terms differ widely. Ask before you sign, and rely on your own limits rather than on a refund.
Does a CAPTCHA stop SMS pumping?
It helps but is not enough alone. Bots can solve or bypass some challenges, and attacks also come through endpoints without one, such as password reset or resend buttons. Combine bot protection with country allow lists, rate limits per number, IP and device, spend caps per country and monitoring of the verification conversion rate.
What is the difference between SMS pumping and toll fraud?
Both create billable traffic to ranges whose revenue is shared with the fraudster. Toll fraud usually needs access to a phone system or SIP account, through hacking or stolen credentials. SMS pumping needs no break-in: bots use the business's public sign-up or OTP forms exactly as designed, which makes it harder to spot without conversion monitoring.
Can voice OTP be abused like SMS pumping?
Yes. Voice OTP calls and any other verification channel that sends something billable to a number typed by a user can be abused the same way, with calls to high cost ranges instead of messages. Apply the same controls to every channel: country allow lists, rate limits, bot checks and spend caps, and watch conversion per channel.
Is SMS pumping illegal?
Carriers and messaging platforms treat it as fraud, and generating fake traffic to collect termination revenue can break fraud laws in many countries. In practice the parties behind it are hard to trace across several countries and carriers, so businesses cannot count on enforcement. Prevention on your own forms and accounts is the reliable defence.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.