In short
- What it is: automated requests that make your application send SMS to numbers chosen by attackers, who earn a share of the delivery revenue.
- Who pays: you. The messages leave your account and are billed like any other.
- Main sign: many more codes sent than codes entered, often to countries you do not serve.
- Protection: application controls and account controls together. Neither layer is enough alone.
How SMS pumping works
The mobile industry calls this artificially inflated traffic (AIT): SMS generated to earn revenue from its delivery, usually far above what the service would normally send.
- The attacker obtains phone numbers, or ranges of numbers, that pay out when a message is delivered to them.
- A script finds a screen in your product that sends an SMS on request: sign-up, login, password reset or "resend code".
- The script requests codes for those numbers again and again, often from many IP addresses.
- Each message is delivered and billed to you. Nobody enters a code.
The OWASP API Security Top 10 uses an SMS "forgot password" flow as its example of this risk: a script calls it tens of thousands of times, and the company loses money within minutes.
Signs your OTP traffic is being pumped
- SMS volume or cost rises without a matching rise in sign-ups or logins.
- The share of codes entered falls sharply.
- Messages go to unusual destinations: countries or number ranges where you have few customers.
- Numbers arrive in sequence, differing only in the last digits.
- Requests come in bursts from a small set of IP addresses, devices or sessions, or from clients that do not behave like your app or a real browser.
Layer 1: controls in your application
These controls sit in your product, because only your application sees who is asking for a code.
| Control | What it stops | How to apply it |
|---|---|---|
| Rate limits | One client triggering many codes | Limit requests per phone number, device, IP address and session, with a growing delay between resends |
| Human check | Scripted requests | Show a challenge before the code is sent, or when a request looks unusual |
| Client screening | Scripts that do not behave like your app | Deny headless browsers; consider blocking Tor exit nodes and well-known proxies |
| Country allow-list | Destinations attackers profit from | Accept numbers only from countries where you have customers |
| Number checks | Numbers that cannot be real customers | Validate the format and reject ranges you never expect |
| Another factor first | Unneeded SMS | For logins, check the password before sending the code |
Layer 2: controls on your SMS account
Application controls reduce the requests. Account controls cap what gets through. On Digital Connect, Interkey's business SMS platform, these are part of your account:
- Fraud protection on your account's traffic.
- Country blocking, so the account sends only to the countries you allow.
- Spending limits that cap what the account can spend.
- A delivery receipt for each message, so you can see where every message went.
- API access restricted to whitelisted IP addresses or a VPN connection, so a leaked credential alone cannot send from another address.
- Two-factor login to the platform with a verification code sent by email, and admin and user permission levels.
The country list and spending limit are set for your account during onboarding. Start from the countries your customers are in and a limit above your normal monthly volume.
The numbers to watch
| Measure | Why it matters |
|---|---|
| Codes entered divided by codes sent, by country | The earliest sign of pumping is a sudden drop |
| Messages per phone number, per IP address and per device | Shows scripted requests |
| Messages to countries you do not normally serve | Points to destinations attackers profit from |
| Daily spend against your normal range | Shows the cost before the invoice does |
| Delivery receipts per message | Shows exactly where messages went |
If an attack is happening now
- Confirm it. Compare codes sent with codes entered for the last few hours, by country.
- Close the destinations. Tighten your application's country allow-list, and ask your SMS provider to restrict the account's countries to the ones you serve.
- Throttle the screen being abused. Lower the rate limits on that flow and turn on the human check for every request.
- Check the spending limit. Make sure it stops the account at a level you can accept.
- Keep the evidence. Export delivery reports and your request logs for the attack window.
- Review with your provider. Go through what happened and adjust the account's country list and limits.
Questions to ask any SMS provider about pumping
- Can our account be limited to the countries we choose?
- Can we set a spending limit on the account?
- Do we get a delivery receipt for each message?
- Can API access be restricted to our own IP addresses or a VPN?
- If our account is attacked, how do you investigate with us, and how are the messages billed?
Questions about SMS pumping
What is SMS pumping?
Fraud in which bots trigger your application to send SMS, usually one-time codes, to numbers that earn the attackers a share of the delivery revenue. It is also called artificially inflated traffic.
Is SMS pumping the same as SMS phishing?
No. Phishing tries to trick the person who receives a message. Pumping targets the business that sends the messages and makes it pay for traffic nobody needs.
Do we pay for pumped messages?
In most cases, yes. The messages are sent from your account and delivered, so they are billed like any other message.
Is a CAPTCHA enough?
No. It makes scripted requests harder, but combine it with rate limits, a country allow-list, account limits and monitoring.
Can provider controls stop pumping on their own?
No. Country blocking, spending limits and fraud protection reduce the damage, but bots still reach your screens. Use both layers.
Does Digital Connect protect OTP traffic from pumping?
Digital Connect accounts have fraud protection, country blocking and spending limits, with a delivery receipt for each message. The application controls in this guide stay in your own product.
When is Digital Connect not a good fit?
If almost all of your users are outside Saudi Arabia, or you send only a few hundred codes a month.