What SMS pumping is and why it costs you
SMS pumping, also called artificially inflated traffic, abuses any form that sends an SMS on request: sign-up, login, password reset or a "send me a link" box. Bots enter phone numbers in ranges the attacker shares revenue on, request codes again and again, and never finish verification. Every message is billed to you.
The attack is hard to see in delivery reports because the messages are delivered. It shows up as a drop in OTP conversion, a rise in requests to countries you do not serve and spend that grows faster than sign-ups.
How the calculator estimates the pumped share
A pumped request never ends with a verified user. If genuine users verify 80% of the time and your observed conversion is 70%, about 12.5% of requests are pumped (1 minus 70 divided by 80). The calculator uses that gap unless you enter a share you measured yourself, and caps the estimate at 95%.
Each request sends 1 plus your resend rate in messages. SMS cost uses our published per-country rates, averaged over operators at the volume tier each scenario reaches. You can price pumped traffic at your own country mix, or at the average of the ten most expensive countries on our rate card, because attackers tend to route traffic to high-cost destinations.
- Every figure is an estimate; the risk score is a heuristic, not a probability
- Conversion of genuine users, WhatsApp reach and the effect of controls are assumptions you can change
- SMS rates exclude taxes and are not a quote
SMS only, WhatsApp first and WhatsApp first with controls
WhatsApp first sends the code with a WhatsApp authentication template and falls back to SMS for users who are not reached. It uses Meta's authentication rate for each market. Numbers used for pumping rarely have WhatsApp, so in this model their requests still fall back to SMS: WhatsApp first lowers the cost of genuine users, and controls are what stop the waste.
The third scenario adds anti-pumping controls on top of WhatsApp first and removes the share of pumped requests you expect them to stop. Voice OTP is shown as a fallback option; voice is priced on request, so contact sales for a quote.
Worked example: 100,000 OTP requests a month
A fintech sends 100,000 OTP requests a month: 50% to the UAE, 30% to Saudi Arabia and 20% to Egypt, with a 20% resend rate. Its conversion is 70% against 80% for genuine users, so about 12.5% of requests are pumped. On SMS only at our published rates that is about $1,830 a month, of which about $229 goes to pumped messages, and $0.026 per verified user.
With WhatsApp first reaching 80% of genuine users, spend falls to about $1,613 and $0.023 per verified user. Adding controls that stop 90% of pumped requests brings it to about $1,379, or $0.020 per verified user. If the pumped traffic went to the most expensive countries instead, the waste on SMS only would be about $950 a month.
Controls that stop SMS pumping
The checklist under the results orders these controls by what your answers make most urgent, and marks the ones you already have. The most effective single step is usually to allow OTP sends only to the countries you serve.
- Country allow-list (geo-permissions) for OTP sends
- Rate limits per phone number, IP, device and session, with a cooldown between resends
- Conversion monitoring by country and prefix, with alerts and automatic pauses
- Bot detection in front of the send-code button
- Blocks on sequential numbers and abused prefixes, plus daily spend alerts