SMS Pumping Fraud — Artificially Inflated Traffic (AIT) / SMS Toll Fraud
What is SMS Pumping Fraud?
SMS pumping fraud — also called artificially inflated traffic (AIT) or SMS toll fraud — is a scheme where bad actors use bots or scripts to trigger large volumes of one-time-passcode or verification texts to premium-rate or fraud-controlled numbers, then collect a cut of the termination fees the sending business gets billed for each message. It typically targets an app's own OTP or two-factor login form rather than a carrier directly, since that flow sends a real, billable SMS on demand with no purchase or human recipient required.
More detail
The attack is cheap to run because it needs no stolen goods or payment fraud — just a script that repeatedly submits phone numbers to a public OTP/verification endpoint, driving up a business's messaging bill while returning no legitimate signups or logins.
Defending against it means detecting the pattern before the message sends, not after: rate-limiting OTP requests per number and per IP, blocking known-abusive number ranges and country codes, flagging repeat submissions from the same source, and monitoring for a sudden spike in send volume or cost concentrated on a handful of destination prefixes.
SMS pumping fraud is a form of artificial inflation of traffic — the same abuse pattern that drives carrier SMS firewalls to filter suspicious routes — but it is initiated against the sending business's own verification flow rather than encountered as a routing problem further downstream.
Frequently asked
- What is SMS pumping fraud?
- SMS pumping fraud (also called AIT or SMS toll fraud) is when bots repeatedly trigger OTP or verification texts to premium-rate or fraud-controlled numbers so the attacker earns a share of the termination fees the sending business is billed for each message — with no real signup or login behind it.
- How can a business protect its OTP flow from SMS pumping?
- Rate-limit verification requests per phone number and per IP address, add a challenge (like a CAPTCHA) before an SMS sends, block known-abusive number ranges and destination countries, and monitor for a sudden spike in OTP volume or cost concentrated on a small set of destination prefixes.
- Is SMS pumping fraud the same as an SMS firewall problem?
- They're related but distinct: SMS pumping fraud (AIT) is the abuse of a business's own OTP or verification flow to generate fraudulent traffic, while an SMS firewall is the carrier-side system that inspects traffic in transit and can end up filtering legitimate messages if a sender's pattern resembles that abuse.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.