How an API-First Company Fixed Sign-Up Verification Fraud and Cut Costs by 62%

SerpApi's free-tier sign-up verification was working as intended, which is exactly what let SMS pumpers turn it into a costly attack. Here's how switching to Prelude closed the gap in hours.

Rowan Haddad

Content & SEO Manager

Summary

SerpApi switched from Twilio to Prelude for phone verification after discovering SMS pumpers had turned its own free-tier abuse prevention into a six-figure-a-year attack. The switch cut SerpApi's monthly verification costs by 62% and lifted phone verification conversion by 14 percentage points overall, with attack-heavy markets like Italy seeing conversion jump from 2.4% to 91.5%. The integration took a few hours. SerpApi is now evaluating WhatsApp as a verification and messaging channel, starting in markets like Brazil.

Founded in 2017, SerpApi converts unstructured search engine results pages into structured, machine-readable data, powering use cases from SEO rank tracking to academic research to large language model training. Its roughly 60-person team serves developers and businesses worldwide, from indie builders to most of the Fortune 500. Unlike a consumer marketplace or app, SerpApi's customers aren't people browsing a product, they're accounts pulling data through an API, which means the fraud problem looks different too.

To let developers try the product before committing, SerpApi offers a generous free tier: 250 searches a month. That openness is exactly what makes it attractive to abuse, since fake email addresses are trivial to generate at scale, so SerpApi added phone verification as a second gate, on the assumption that requiring a real phone number would be enough to stop someone from spinning up dozens of free accounts to multiply their free search allowance.

We spoke with Thilo Rusche, Senior Engineer at SerpApi, about how customer complaints from legitimate users led to an investigation which turned into a six-figure discovery, and what switching to Prelude changed.

SerpApi's Free-Tier Verification Becomes a Target for SMS Pumpers

Thilo's own summary of what happened cuts right to the twist in this story:

"It was not that verification didn't work, it was working too well, and people were abusing this to send premium text messages with never an intention of actually creating an account with us."

In other words, the gate SerpApi built to stop free-tier abuse wasn't the thing attackers were trying to get past. It was the thing they wanted to hit directly, running traffic through it purely to generate premium SMS charges, with “no intention of using SerpApi’s search API.

Thilo found the issue while investigating a rise in failed verifications that looked at first like ordinary free-tier abuse:

"Nobody really had SMS pumping on the radar, including myself. We first tried to figure out why there were so many verifications failing all of a sudden; there was a particular spike. So I dug into our Twilio bills, and the numbers were, on average, $30,000 a month. That seemed extremely high."

Drilling into the usage pattern turned up distinct spikes concentrated in specific countries, including, as Thilo put it, "somewhere in the middle of Africa where we don't have many users, but the termination fees are really high." Feeding the pattern into AI-assisted analysis confirmed it: classic SMS pumping, exploiting the same verification flow SerpApi had built to stop free-tier abuse, not the free-tier abuse itself.

Twilio never proactively alerted SerpApi to the problem. SerpApi only found the pattern because its customer success team started fielding complaints from legitimate users across Europe who couldn't verify their phone numbers at all:

"It turns out the little bit of fraud prevention Twilio was doing was very broad-brush. When they discovered a pattern, they'd block whole prefixes for twelve hours, and those blocks affected legitimate users trying to verify their number. That's how we discovered it in the first place."

Getting help from Twilio directly was its own problem. Despite paying roughly $30,000 a month, SerpApi was on a support tier with no dedicated support:

"The first response to the ticket took weeks, and it was useless, probably automated. I had to go back and forth. After a month, no resolution, no help, nothing. That's when we got frustrated enough to look for alternatives."

The invoice itself was part of the problem: separate line items for "Verify" and "Programmable Messaging" with totals that didn't add up cleanly against either figure, despite SerpApi only ever using the Verify endpoint. It's a split that trips up more Twilio customers than just SerpApi, as we've covered in Top 10 Twilio Competitors for OTP & SMS APIs. Thilo had asked Twilio support to explain it directly and came away no clearer:

"I asked this question in a support ticket about the difference between programmable messaging and verify. I just don't think it was explained very well."

SerpApi Switches to Prelude Without Missing a Beat

SerpApi didn't run a lengthy vendor bake-off. Thilo used AI-assisted research to scan alternatives, found Prelude, ran a trial, and didn't look any further:

"I found Prelude among a few others and we decided to try it. I don't think I tried any others. The trial went very well, and here we are."

What stood out immediately was visibility, the thing Twilio had made almost impossible. Thilo had been reduced to exporting raw CSV dumps (capped at roughly 9,000 records) and analyzing them himself just to see what was happening with his own traffic:

"It's no comparison, even without the support, which is fantastic. Just as tools: the graphs are fantastic, drilling down by country, by error code, by any time frame. With Twilio, everything was artificially restricted. Even the bill history: you can only look at a 12-month window, which strikes me as a completely artificial restriction, because the data is all there. It seems unnecessarily hard to get data out of."

The engineering lift was minimal. SerpApi builds directly against the API over HTTP rather than relying on SDKs, so switching over from Twilio's near-identical endpoints took a few hours of engineering time, with the rest of the migration limited to coordinating with the customer success team:

"This is not a particularly hard problem, the API is very good, and most APIs for SMS delivery are quite simple. We built the code on our end within a few hours. It was basically just a modification of the one we already had with Twilio."

Having a direct line to the Prelude team changed the day-to-day, too. SerpApi runs the same model for its own biggest customers, so the contrast with Twilio's silence was immediate:

"It's literally no comparison, because I have nothing to compare it with. We didn't have support from Twilio. Now we work the same way we do for our own biggest customers: a dedicated Slack channel. We're really grateful for it."

The Results: Costs Down, Conversion Up, Pumpers Blocked

Comparing representative samples of traffic between Twilio and Prelude:

62% lower monthly invoice
69% lower messaging usage charges
47% lower cost per successful verification
Overall conversion up 14 percentage points

Italy showed the clearest before-and-after of any market in the results. It's one of the places where Twilio's broad prefix-blocking locked out legitimate users, and where an automated, nightly pumping attack was running before the switch. With both resolved, monthly messaging charges in Italy fell 99.7%, and conversion jumped from 2.4% to 91.5%.

Thilo described that Italy attack in detail as proof of how fast Prelude responded once they switched. He'd been tracking the pattern for a while, running on a nightly automated schedule, and expected it to show up again the day SerpApi went live on Prelude:

"The first one we expected on the day we switched was the one we got from Italy, because that was clearly on a scheduled script. It was running every day at midnight, for an hour or two. So that reared its head when we switched to Prelude, but it basically stopped the next day. I don't know if it was actively blocked on the Prelude side or if the pumpers just realized it wasn't getting through anymore."

A more recent attack, from Pakistan, surfaced just days before this conversation, and this time, Prelude's team caught it before SerpApi did:

"I actually noticed it in the morning, but by the time I went on Slack, the support team had already said, 'hey, we're seeing a spike here.' It took a few days, but it's now almost down to zero. The pumpers are still trying, but they're getting actively blocked."

Asked to put a number on the overall shift:

"We basically reduced our bill to a third of what it was."

What's Next for SerpApi: Bringing WhatsApp Into the Mix

With verification costs and fraud under control, SerpApi is now looking at WhatsApp as an additional channel, not to replace SMS everywhere, but to improve delivery and cost in markets where WhatsApp is the dominant way people communicate:

"We're looking into integrating WhatsApp as a channel, because of certain countries where WhatsApp is very prevalent and SMS delivery is less so, Brazil, for example. Once we have a business WhatsApp account set up, we'll trial it in one market, see if it improves conversion and reduces delivery cost, and if that works, we might just enable it globally."

Asked whether he'd recommend Prelude to another API-first or infrastructure company facing similar fraud or visibility problems, Thilo said yes without hesitation, especially for any team already looking for a Twilio alternative due to poor support experiences of their own.

SerpApi's experience shows what happens when a fraud-prevention gate gets targeted directly, and what changes when the provider behind it actually has visibility into what's going on. Ready to see similar results?