SMS Pumping and OTP Fraud: How to Protect Your Signup Flow

If your app sends verification codes, there is a good chance someone has already tried to make money from it. SMS pumping — also called artificially inflated traffic (AIT) or SMS toll fraud — is one of the most common and expensive abuses of OTP endpoints. This article explains how it works and how to defend against it.

How the scam works

Some telecom routes, especially to certain international ranges, pay a share of termination fees back to whoever controls the destination numbers. An attacker who controls a block of those numbers — often in collusion with an intermediary carrier — wants as many SMS as possible delivered to them.

Your signup form is the perfect pump:

1. A bot submits thousands of phone numbers from the attacker's ranges.
2. Your backend dutifully sends an OTP to each one.
3. You pay per message; part of that fee flows back to the attacker.
4. No account is ever completed — the codes are never typed in.

The tell-tale pattern is a spike of OTP sends to a narrow set of country codes or number prefixes, with conversion (code entered) close to zero.

Why it is so costly

International SMS can cost anywhere from a cent to over twenty cents per message. A modest bot sending 50,000 requests overnight can generate a four- or five-figure bill before anyone notices. Because each request looks like a normal signup, naive rate limits on a single IP rarely catch it — attackers rotate residential proxies.

A layered defence

No single control is enough. Combine several, ordered from cheapest to most intrusive:

1. Measure conversion per destination

Track sends and successful verifications per country code and per number prefix. Alert when a prefix's conversion rate falls far below its baseline while volume rises. This one metric catches most pumping attacks within hours.

2. Geo-permissions

Only allow SMS to countries where you actually have customers. Most SMS providers let you disable destinations entirely. If you launch in a new market, turn it on deliberately.

3. Rate limits on several keys

Limit OTP sends by IP, by device fingerprint, by destination number, and by destination prefix. A burst of different numbers sharing the same first seven digits is a strong signal.

4. Bot friction before the send

Put an invisible challenge (Cloudflare Turnstile, reCAPTCHA v3 or similar) in front of the send code action — not just the final submit. Attackers target the cheapest request that triggers a cost.

5. Progressive verification

Ask for an email or social login first and only request a phone number later, once the user has shown intent. Fewer anonymous requests reach the SMS step.

6. Exponential resend timers

Allow one resend after 30 seconds, the next after 60, then 120. Real users rarely need more than two attempts; bots hit the wall immediately.

7. Provider fraud tools

Most verification APIs now include fraud scoring. Turn it on, review what it blocks, and keep your own metrics as a cross-check.

Don't punish legitimate users

Over-aggressive blocking hurts conversion, especially in markets where many people share devices or use prepaid SIMs. A few principles keep real users flowing:

• Prefer soft friction (a challenge, a delay) over hard blocks.
• Offer an alternative factor — email, authenticator app or passkey — when SMS is throttled.
• Log every block with the reason so support can unblock genuine cases quickly.

Where temporary numbers fit

Temporary numbers are sometimes lumped together with fraud, but the two are very different. Pumping attacks never read the codes; legitimate temp-number users — QA testers, developers, privacy-conscious people — rent a single number and type the code in. The conversion signal above distinguishes them cleanly.

OTP Bolt is designed for that legitimate side. Accounts are email-verified, payments use 3-D Secure on every card, and accounts with repeated declined payments are automatically locked for review. We also ask everyone to respect each platform's terms — temp numbers are for testing, privacy and one-off signups, not for evading bans or abuse.

Checklist for your OTP endpoint

• Dashboards for sends vs. verifications per country and prefix.
• SMS destinations limited to countries you serve.
• Rate limits on IP, device, number and prefix.
• Bot challenge before send code.
• Escalating resend timers.
• Provider fraud scoring enabled and reviewed.
• Alternatives to SMS for users who need them.

Put these in place and SMS pumping turns from a surprise invoice into a blip on a dashboard.