--- title: "SMS Pumping Fraud and OTP Cost Calculator" description: "Estimate what SMS pumping costs your OTP flow, your real cost per verified user, and how much WhatsApp-first delivery and anti-fraud controls can save." canonical: "https://omnichannels.ai/tools/sms-pumping-fraud-calculator/" language: "en" updated: "2026-10-10" publisher: "BroadNet Technologies" brand: "OmniChannels.ai" --- # SMS Pumping Fraud and OTP Cost Calculator Canonical: https://omnichannels.ai/tools/sms-pumping-fraud-calculator/ Language: en Publisher: OmniChannels.ai by BroadNet Technologies SMS pumping is fraud where bots request one-time passwords to numbers the attacker profits from, so you pay for messages no real user reads. Pumped requests never complete verification, so the gap between your OTP conversion and the conversion genuine users reach estimates the pumped share. Multiply those requests by your sends per request and the SMS rate to see the waste, then compare WhatsApp-first delivery and controls. ## How to estimate your SMS pumping cost 1. **Enter your OTP traffic:** Add monthly OTP requests from sign-ups and logins, the countries your users are in and your resend rate. 2. **Add your conversion:** Enter the share of OTP requests that end with a verified user. The calculator compares it with the conversion genuine users reach. 3. **Tick warning signs and controls:** Mark the warning signs you have seen and the controls already in place. They drive the risk score and the checklist. 4. **Compare the scenarios:** Read the monthly and annual spend, waste and cost per verified user for SMS only, WhatsApp first and WhatsApp first with controls. ## What SMS pumping is and why it costs you SMS pumping, also called artificially inflated traffic, abuses any form that sends an SMS on request: sign-up, login, password reset or a "send me a link" box. Bots enter phone numbers in ranges the attacker shares revenue on, request codes again and again, and never finish verification. Every message is billed to you. The attack is hard to see in delivery reports because the messages are delivered. It shows up as a drop in OTP conversion, a rise in requests to countries you do not serve and spend that grows faster than sign-ups. ## How the calculator estimates the pumped share A pumped request never ends with a verified user. If genuine users verify 80% of the time and your observed conversion is 70%, about 12.5% of requests are pumped (1 minus 70 divided by 80). The calculator uses that gap unless you enter a share you measured yourself, and caps the estimate at 95%. Each request sends 1 plus your resend rate in messages. SMS cost uses our published per-country rates, averaged over operators at the volume tier each scenario reaches. You can price pumped traffic at your own country mix, or at the average of the ten most expensive countries on our rate card, because attackers tend to route traffic to high-cost destinations. - Every figure is an estimate; the risk score is a heuristic, not a probability - Conversion of genuine users, WhatsApp reach and the effect of controls are assumptions you can change - SMS rates exclude taxes and are not a quote ## SMS only, WhatsApp first and WhatsApp first with controls WhatsApp first sends the code with a WhatsApp authentication template and falls back to SMS for users who are not reached. It uses Meta's authentication rate for each market. Numbers used for pumping rarely have WhatsApp, so in this model their requests still fall back to SMS: WhatsApp first lowers the cost of genuine users, and controls are what stop the waste. The third scenario adds anti-pumping controls on top of WhatsApp first and removes the share of pumped requests you expect them to stop. Voice OTP is shown as a fallback option; voice is priced on request, so contact sales for a quote. ## Worked example: 100,000 OTP requests a month A fintech sends 100,000 OTP requests a month: 50% to the UAE, 30% to Saudi Arabia and 20% to Egypt, with a 20% resend rate. Its conversion is 70% against 80% for genuine users, so about 12.5% of requests are pumped. On SMS only at our published rates that is about $1,830 a month, of which about $229 goes to pumped messages, and $0.026 per verified user. With WhatsApp first reaching 80% of genuine users, spend falls to about $1,613 and $0.023 per verified user. Adding controls that stop 90% of pumped requests brings it to about $1,379, or $0.020 per verified user. If the pumped traffic went to the most expensive countries instead, the waste on SMS only would be about $950 a month. ## Controls that stop SMS pumping The checklist under the results orders these controls by what your answers make most urgent, and marks the ones you already have. The most effective single step is usually to allow OTP sends only to the countries you serve. - Country allow-list (geo-permissions) for OTP sends - Rate limits per phone number, IP, device and session, with a cooldown between resends - Conversion monitoring by country and prefix, with alerts and automatic pauses - Bot detection in front of the send-code button - Blocks on sequential numbers and abused prefixes, plus daily spend alerts ## SMS pumping and OTP cost FAQ ### What is SMS pumping fraud? It is fraud where bots trigger OTP or other on-request SMS to phone numbers the attacker earns from. The messages are delivered and billed, but no real user reads them, so you pay for traffic that never converts. ### How can I tell if my OTP flow is being pumped? Watch OTP conversion by country and prefix. Pumped requests never complete, so a drop in conversion, requests to countries you do not serve, sequential numbers and many requests from one IP or device are the main warning signs. ### How does the calculator estimate fraud without my logs? It compares your observed OTP conversion with the conversion genuine users reach, which you can change. The gap is the estimated pumped share. If you have measured the share yourself, tick the option and enter it instead. ### Does WhatsApp authentication stop SMS pumping? It lowers the cost of genuine users and is not billed by SMS routes. But numbers used for pumping rarely have WhatsApp, so if every failed WhatsApp send falls back to SMS the attack continues. Country allow-lists, rate limits and conversion monitoring are what stop it. ### Which rates does the calculator use? SMS uses our published per-country rates, averaged over operators at the volume tier each scenario reaches. WhatsApp uses Meta's authentication list rate for each market. Taxes, volume tiers on WhatsApp and authentication-international rates are left out. ### How much does voice OTP cost? Voice OTP is priced per route on request. The calculator shows it as a fallback option without a price; contact sales with your countries and volumes for a quote. ### What is a normal OTP conversion rate? It depends on your product, audience and country, so the calculator does not assume a benchmark. Use the conversion you see on days or in countries with no sign of fraud as the genuine-user figure. ### Is the risk score a probability of fraud? No. It is a heuristic from 0 to 100 based on your conversion gap, the warning signs you ticked and the core controls you are missing. Use it to decide what to fix first, not as a measurement.