Definition
SMS pumping is fraud in which bots trigger large numbers of SMS messages, usually OTPs, from a business's sign-up or login form to numbers controlled by the fraudster, who takes a share of the termination revenue while the business pays for messages nobody uses.
The attacker finds a public form that sends an SMS (sign-up, login, "resend code", password reset), then submits thousands of phone numbers in ranges where a complicit party earns revenue on each terminated message. The codes are never entered. The GSMA describes this as artificial inflation of traffic: the enterprise incurs inflated A2P SMS costs without added value.
Warning signs: a sudden rise in OTP volume without a matching rise in sign-ups, traffic to countries you do not serve, sequential or similar numbers, and a falling verification completion rate (codes entered divided by codes sent).
Defences: rate limits per phone number, IP, device and session; a country allowlist that matches where your customers are; bot protection (CAPTCHA or device attestation) before sending; exponential back-off on resends; and alerts on completion rate per country. Moving verification to WhatsApp authentication templates or app-based authenticators also reduces exposure, though no channel is immune.
Pumping hits international routes hardest, so review spend per destination daily during an attack and ask your provider to block affected ranges.
Example
Normal day: 5,000 OTPs, 4,100 entered. Attack day: 60,000 OTPs, 4,300 entered — most of the extra traffic went to two unexpected countries.