SMS Pumping Fraud: How Fake Traffic Drains OTP Budgets

Imagine your sign-up form sends a code to any number a visitor types. An attacker types thousands of numbers in a country where each message earns them a share of the fee. You pay for every message. That is SMS pumping, also called artificial traffic.

How it works

The attacker finds a form that sends a code without a login.
A script submits many phone numbers, often in one or two expensive destinations.
Each message costs you money.
The attacker or a partner collects a part of that fee.

Warning signs

A sudden rise in code requests with a low completion rate.
Many requests from one country you do not serve.
Sequential or patterned numbers.
A bill that does not match your real users.

Defences that work

Rate limit by IP, by device and by number.
Allow only the countries you really serve.
Add a bot check before the code is sent.
Require an email step or a login before an SMS.
Cap the daily SMS spend and alert at a threshold.
Track the completion rate per country and pause any route with a very low one.

What does not work alone

A simple CAPTCHA that is not tied to the request and a long resend timer on the page can both be bypassed by a script that calls your endpoint directly. Enforce limits on the server.

Testing your own flow

Developers who test sign-up flows can use a virtual number instead of real customer numbers, so test traffic stays easy to separate from real traffic.

How to check if you are affected

Export code requests by country for the last week.
Compare with your sign-up countries.
Look at the completion rate per country.
Look for bursts at night.
Check your provider bill for destinations you do not serve.

Short-term response

Turn on a country allow list.
Lower rate limits.
Add a bot check to the form.
Ask your provider about spend caps and fraud tools.

Questions people ask

Is pumping a hack?

It abuses a normal feature. The form works as designed, so you must add limits.

Which countries are targeted?

It varies. Allow only the countries where you have customers.

Related guides and pages

Create a free OtpGet account and try it with a small balance.