Short answer
To stop SMS pumping fraud, limit who can trigger an OTP, how often and to which countries. Rate-limit requests per phone number, IP, device and session; allow only countries you serve; add bot protection before sending; slow down resends; and alert when the share of codes actually entered drops. Ask your provider to block abused ranges.
What SMS pumping is
SMS pumping, which the GSMA calls artificial inflation of traffic (AIT), happens when bots submit thousands of phone numbers to a sign-up, login or reset form. A party at the terminating end shares the revenue from each message with the fraudster. The codes are never entered, and the business pays for every message.
Warning signs
- OTP volume rises without a matching rise in sign-ups or logins.
- Traffic goes to countries you do not serve.
- Requests use sequential or very similar numbers.
- Verification completion rate (codes entered divided by codes sent) falls, often in one or two countries.
Controls to put in place
- Set a destination-country allowlist that matches your customer base.
- Rate-limit per phone number, IP address, device and session.
- Add a CAPTCHA or device attestation before any SMS is sent.
- Use exponential back-off on resend requests.
- Track completion rate per country and alert on drops.
- Set spend caps and alerts per destination with your provider.
During an attack
Review spend per destination daily, block affected countries or ranges at once, and ask your provider to block them on its side too. Moving some users to WhatsApp authentication templates or authenticator apps reduces exposure, but no channel is immune; voice OTP and flash calls can be abused for revenue share fraud as well.