Quick answer: An SMS gray route is a message path that delivers application-to-person (A2P) traffic — your OTPs, alerts, and campaigns — as if it were ordinary person-to-person (P2P) foreign-origin traffic, bypassing the registered route and its per-message fees. SIM farming (SIM boxing) is the variant where the gray route terminates in boxes of physical SIM cards flooding numbers, often to pump OTP traffic for revenue. In 2026, carriers have raised unregistered-origin surcharges and fraud-screening regimes sharply, so gray routes increasingly bill out as the expensive option — and tenants get caught holding the liability when a routed provider quietly sends their traffic "off the record." On the Devotel Orbit platform, the entire compliance posture — sender registration, frequency caps, message suppression, fraud monitoring — is tenant-specified and tenant-owned, so you can hold your traffic to the registered, legitimate kind.
This is the one SMS fraud class a buyer can both fall victim to and accidentally commit: a cheap upstream route is still a gray route even when you did not choose it, and "your sender ID arrived spoofed" is a regulator-side violation, not a billing surprise.
How gray routes work — and why 2026 carriers price them as a penalty
A legitimate A2P SMS route is registered end to end: a declared sender ID, a campaign or brand registration where the destination regime requires it (10DLC in the US, DLT in India, sender-ID registries in much of Europe and APAC), and an agreed per-message tariff. A gray route substitutes for any of that:
- Sender-ID spoofing. The message arrives from a stolen or generic alphanumeric ID attached not to your brand but to the gray-route operator's pool — so the destination carrier sees an unregistered origin and the recipient sees a sender that cannot be held accountable.
- P2P-path injection. A2P traffic is pushed onto consumer person-to-person SIM paths where the per-message termination fee is lower or nonexistent, avoiding the A2P tariff that funds carrier screening and registration.
- Hop washing. The message crosses an intermediate aggregator that re-originates it, so the leg responsible to the destination carrier is not the originator — laundering the origin into "foreign P2P" before delivery.
In 2026 all three moved from grey-area discounting to explicit liability. Carrier and regulator regimes — including the US TCR regime, India's DLT, and EU sender-ID registration pushes this cycle — increasingly impose unregistered-origin surcharges priced above the registered tariff, and carriers apply screening-level blocking before delivery. The gray route stopped being "cheap" and became "billable-as-spam": the real cost has inverted the discount.
SIM farms: pumping at the box level
SIM farming — "SIM boxing" — terminates traffic through racks of physical SIM cards (hundreds or thousands of consumer subscriptions in one box), making A2P traffic indistinguishable from P2P at the carrier's inbound switch. A SIM farm is the physical incarnation of a gray route; it is also the infrastructure for SMS pumping, where the farm's own pool of numbers drives traffic for revenue (see the sibling explainer SMS pumping fraud in 2026 for the artificial-traffic-inflation side).
The 2026 SIM-farm news is not a new technique; it is enforcement catching up. Carriers now treat a SIM box hammering A2P traffic as a fingerprint for both gray-route avoidance and OTP pumping, and the same fraud-screening feeds that name SIM-farm ranges name destination prefixes flagged for artificially inflated traffic. If your provider routes your OTPs through a SIM-farm gray route — or your own verification form drives publishes to one — carrier-side screening blocks it by range, not by message.
The OTP spam alert: link fraud signals to your monitoring
The gray-route and SIM-farm exposure lands on the same endpoint SMS pumping lands on: your OTP and verification form. If you run OTP on Orbit, the detection and policy posture is framed in the sibling post Verify APIs and OTP fraud monitoring, including the pre-send Fraud Guard and the verification.fraud_blocked and account.fraud.alert webhook events you can route into your incident path. If a traffic spike or an inbound-complaint pace suggests gray-route residue on your sender identity, check the conversion-anomaly report before the next campaign run rather than after.
Tenant-side controls to configure
Gray-route resistance on Orbit is a tenant posture, not a platform mandate — the platform gives you the registration surface and the hooks; what your traffic declares and tolerates is your compliance-and-risk call. The five levers worth setting on day one:
- Register your sender identity with the regime that governs the destination. For US destinations that means a 10DLC brand and campaign; for India, DLT registration; for alphanumeric destinations that require it, a registered sender ID filed through the dashboard. Legitimate-registered is the only posture any of these routes respect.
- Set frequency caps, and rotate verification-code validity. Cap the SMS velocity per recipient and per destination via the frequency caps guide, so a bot that probes your OTP form or your campaign flow hits a tenant-side limit before it accumulates synthetic traffic volume — and keep OTP codes on short rotation so a farmed interception ages out before it can be replayed.
- Configure message suppression for complaint-driven removals. Wire the message suppression guide so a number that opts out, or that triggers a complaint-level block, stops drawing sends — both a spam-complaint guard and a pump-run stop-loss.
- Subscribe to fraud monitoring alerts. Route
verification.fraud_blockedandaccount.fraud.alertwebhooks into the same on-call path as your production alerts; a route-side block without an incident-route is a route-side block nobody reads. - Read the conversion-anomaly report per destination. A destination prefix that arrives through a SIM-farm range reads exactly like a pumped prefix: high send volume, near-zero verified or delivered. The conversion-anomaly endpoint ranks it against your tenant baseline.
None of these is a platform guarantee that no third party will ever gray-route your traffic — they are the levers you own when they try.
Worked examples
(a) Detection: route-side evidence you actually receive
When a SIM-farm or gray-route pattern lands on your verification surface, your synchronous signals are the pre-send Fraud Guard's refusal and the conversion-anomaly report from the same infrastructure the SMS pumping explainer describes. The event shape the webhook emits on a refusal carries the risk score and the reasons — the ones to page on are the ones naming roaming plus risk-block, the classic SIM-farm fingerprint. Full payload shapes: the webhook events reference.
(b) Mitigation: your registered, capped, suppressed posture
If you suspect a vendor or route put your traffic off the record, reload the tenant posture under frequency caps and message suppression, re-register your sender identity, and run the conversion-anomaly report against the suspect destination window. Because suppression and caps are tenant-owned, you can tighten them without waiting for a provider-side decision — and because your sender registration is tenant-filed, the evidence for the destination regime is yours to present.
Frequently asked questions
What is an SMS gray route?
A message path that delivers A2P traffic as if it were P2P foreign-origin traffic — spoofed sender IDs, P2P-path injection, or hop-washed origin — to avoid the per-message tariffs and screening of a registered route. In 2026, carriers price that avoidance above the registered tariff.
What is SIM farming (SIM boxing)?
Racks of physical SIM cards terminating traffic so A2P flows look like consumer P2P at the inbound switch; the SIM farm is also the infrastructure for OTP pumping, since the farm's number pool drives the traffic. Carrier fraud screening treats SIM-farm ranges as a blocking signal.
Is a gray route cheaper than a legitimate route?
No — not in 2026. Destination carriers impose unregistered-origin surcharges and pre-delivery blocking that exceed the registered route's per-message cost, so the gray route is now a billing trap plus a compliance violation.
How do I know my traffic hasn't been gray-routed by an upstream provider?
If your sender ID arrives spoofed, your destination conversions drop, and your delivery receipts disagree with your sender-side sends, re-register your sender identity, set tenant-side frequency caps, and run the conversion-anomaly report against the suspect windows.
Where does Orbit's fraud monitoring fit?
The pre-send Fraud Guard and the tenant-facing verification fraud alerts (verification.fraud_blocked, account.fraud.alert) flag both pumped and SIM-farm fingerprints on your verification surface — as tenant-specified policy. The OTP fraud monitoring explainer walks the full posture.
How to keep your SMS traffic off gray routes
- Register every sender identity with the destination regime before first send. US 10DLC, India DLT, alphanumeric sender registries — filed in the dashboard as your tenant posture, verified as shipped.
- Configure frequency caps per recipient and destination. Set the caps before traffic touches them; the guide is the reference.
- Wire message suppression to complaint and opt-out events. Configure it in the message suppression guide so a stop-loss never waits for support.
- Subscribe to fraud-monitoring events.
verification.fraud_blockedandaccount.fraud.alertgo into your incident route; the OTP fraud monitoring post shows the flow shapes. - Check conversion-anomaly by destination before every campaign. The endpoint ranks prefixes against your tenant baseline and prices the exposure.
The takeaway
Gray routes and SIM farms are the two halves of the same 2026 fraud class: traffic that dodges registration or terminates in a SIM box is now priced as a penalty and screened as spam. The defense is a tenant-owned posture — registered sender identity, capped velocity, suppression on complaint, monitored anomaly — because you cannot outsource the liability, only the routing. The sibling posts SMS pumping fraud in 2026 and Verify APIs and OTP fraud monitoring cover the OTP-specific posture; this one frames the route regime that makes those postures necessary.