SMS Pumping Fraud: What it is, How to Detect it, and How to Prevent it
If your app uses phone verification, you will most likely be a victim of SMS Pumping Fraud. Here's everything you need to know about it.
Rowan Haddad
Content & SEO Manager
Summary
SMS pumping fraud exploits phone verification flows to send traffic to premium-rate numbers attackers control, and the business sending the codes pays for every message. Prelude’s analysis of 205 million authentication requests in 2025 found that 11.83% of verification traffic was fraudulent. Prelude Verify blocks these requests before any message goes out. This guide covers how the attack works, the signals that expose it, and the controls that stop it.
If your app uses phone verification, you will most likely be a target of SMS pumping fraud at some point. Prelude's analysis of 205 million authentication requests in 2025 found that 11.83% of all verification traffic was fraudulent, with $3.26 million in SMS costs prevented across the dataset (Prelude 2025 SMS Pumping Fraud Report). Industry-wide, Juniper Research estimated that enterprise losses to artificially inflated traffic, the category SMS pumping belongs to, peaked at $2.1 billion in 2023.
SMS pumping is one of several OTP fraud types that exploit phone verification flows. Attackers exploit phone verification flows to generate SMS traffic to premium-rate numbers they control, forcing businesses to absorb the messaging costs. For the full landscape, see our Complete Guide to OTP Fraud.
In this guide, we’ll break down what SMS pumping fraud is, how it works, and most importantly, how to protect your business from this growing threat.
What is SMS Pumping?
SMS pumping is a type of fraud where attackers trigger large volumes of text messages to phone numbers they control, then collect a share of the fees each message generates. Most attacks target OTP and verification endpoints, because any form that sends an SMS when a phone number is submitted can be automated.
Fraudsters typically work with complicit mobile operators or intermediaries that pay out on terminated traffic. The business sending the messages pays for every one, so the financial damage lands on the victim.
Also known as SMS Toll Fraud or Artificially Inflated Traffic (AIT), SMS pumping is a variant of International Revenue Share Fraud (IRSF). The underlying mechanism is the same (exploiting telecom revenue-sharing agreements), but SMS pumping specifically targets your OTP and verification endpoints rather than traditional telecom infrastructure.
Unlike account takeover or credential stuffing attacks, the attacker’s goal is not to access user accounts or steal data.
The goal is much simpler: generate billable SMS traffic at scale. Prelude Verify is built to stop this before the first message goes out: it scores every verification request for fraud risk and blocks high-risk ones, so pumped numbers never receive a code.
How SMS Pumping Works
SMS pumping requires two things: access to a high-volume OTP endpoint and a relationship with a telecom route that pays out on traffic.
Step 1 - The attacker secures a revenue share. Fraudsters start by partnering with unethical carriers or gaining access to premium-rate numbers. They promise these operators high SMS volumes and increased revenue, using international premium-rate numbers (IPRNs) to drive traffic.
Step 2 - They identify a target point. Sign-up forms, login pages, password reset flows, and promotional redemption forms turn into targets- basically, any endpoint that triggers an SMS when a phone number is submitted.
Step 3 - Bots flood the endpoint. The fraudsters flood the system with SMS traffic, cycling through real-looking number formats in the target ranges. Your system sends OTP messages to those numbers. The fraudster collects a cut of the per-message fee. These SMS messages are routed to premium numbers controlled by the fraudsters, usually in foreign countries, inflating the cost for businesses that pay per message.
Step 4 - The damage stays hidden until the bill arrives. Every message that reaches the attacker’s numbers earns a termination fee, which the colluding carrier shares with the fraudsters. This is what makes SMS pumping particularly damaging. The traffic generates no failed logins, no suspicious access events, and no user complaints. Every message shows up as successfully delivered. The first sign is typically a billing anomaly, often days or weeks after the attack ran.
In short, both the scammers and their rogue partners profit from the fake SMS traffic, while the victim is left covering the costs.
Why OTP Systems are Particularly Vulnerable
SMS pumping works because OTP systems have a structural vulnerability built in by design: the send endpoint has to be public, the cost is absorbed by the platform, and success doesn’t require a real user on the other end.
In practice, this means that a sign up form or password reset flow has to accept requests from anyone. Unlike authenticated API endpoints that require a valid session or token, OTP send endpoints are open by nature. There is no credential to steal, no session to compromise. Any bot can trigger them.
Plus, verification flows tend to be predictable. Sign-up forms, password reset flows, and login pages follow consistent patterns in that they accept a phone number, trigger a send, and wait for a code submission, which means that bots can easily replicate this flow at scale.
The platforms, for their part, absorb the costs regardless of the outcome. Every message your system sends generates a charge, whether or not a real user requested it, whether or not the code is ever submitted, and whether or not the phone number even exists. In other words, they bear the entire cost of every request, fraudulent or not.
Furthermore, telecom billing creates a direct revenue model for attackers. The global SMS routing system was built on carrier settlement agreements. Fraudsters insert themselves into this system by acquiring or partnering with number ranges that generate a payout on termination. Every OTP your system sends to those numbers puts money in the attacker's pocket. There is no equivalent mechanism in most other fraud types; SMS pumping is one of the few attacks where the infrastructure of the victim's own provider directly funds the attacker.
This type of fraud can unleash some major damage because many applications lack capabilities such as device intelligence, behavioral analysis, carrier risk scoring, adaptive rate limiting and fraud-aware verification controls.This creates an environment where attackers can generate massive OTP traffic with very little resistance.
The only defense that can reliably address SMS pumping before it inflicts damage is actually evaluating the destination number before sending, which many OTP implementations don’t do.
SMS Pumping Examples
The fintech app: Promo campaign gone wrong
A fintech app launches a referral campaign: a user invites a friend, both accounts get $80 in credit. To claim the reward, the referred user just needs to sign up and verify their phone number.
Within 48 hours of the campaign launch, the OTP send volume is 40 times the expected rate. Bots are hammering the sign-up endpoint with thousands of phone numbers per hour, all routed to premium-rate ranges the attacker controls. The referral mechanic doesn't even matter; the attackers aren't after the $80 credit. They're after the OTP messages themselves. Most of the "new accounts" created during the attack show zero activity and are never used again.
Because the messages appear successfully delivered, the attack goes undetected until billing alerts trigger days later. The first signal was the bill.
The business: Fake signups at scale
Consider a subscription retailer that offers customers 15% off their first subscription in exchange for entering their phone number on the website.
Once a customer enters their phone number, the company sends an SMS with a discount code. It’s a simple strategy to boost signups from interested customers.
But fraudsters see an opportunity. They use bots to flood the website with thousands of fake phone numbers. Each number triggers an SMS that is routed to a premium-rate number controlled by the scammers.
The company ends up with a huge bill for all those SMS messages but no real customers. Every text they sent went to fraudulent numbers, benefiting the scammers. Every message went to a fraudulent number that was never going to convert.
Because the traffic passes through several networks before reaching its destination, businesses rarely find out who is behind an attack. That’s why prevention has to happen before the message is sent.
The platform: $60M/year in fake 2FA traffic
Even the largest platforms with significant engineering resources are not immune. Elon Musk publicly reported in 2023 that Twitter was being charged approximately $60 million per year for fake 2FA SMS messages generated by telecom fraud schemes, which illustrates how quickly SMS pumping scales when left undetected.
How SMS Pumping Fraud hurts Your Business
SMS fraud is widespread and can impact businesses in many ways:
Direct financial loss
This is the most immediate impact. Fraudulent SMS traffic leads to massive financial hits. Since businesses pay for every SMS they send, scammers can exploit this to drive up costs by routing messages to premium numbers they control.
Every fraudulent OTP send is a real charge. Your platform pays per message, and attackers will exploit that for as long as they can. Attacks also arrive in bursts. In May 2025, Prelude blocked 763,212 fraudulent requests in a single attack targeting Nigerian numbers (Prelude 2025 SMS Pumping Fraud Report).
Unlike most fraud, SMS pumping losses are rarely recoverable. By the time the bill arrives, the messages have already been sent and the fees charged.
That’s why having strong promotion abuse prevention tools in place, like real-time monitoring and automatic blocking, is essential to protect both your users and your budget.
Platform Abuse and Fake Account Growth
SMS pumping rarely happens in isolation.
The same infrastructure used to generate fraudulent OTP traffic is often used for fake account creation, referral abuse, spam campaigns, synthetic onboarding, and promotion abuse.
As fraudulent accounts accumulate, moderation, compliance, and trust problems grow across the platform.
Metric pollution and bad data
SMS pumping generates fake accounts at scale. Your sign-up numbers, DAU, MAU, and cohort data all get inflated with users who don't exist.
Your user base gets inflated with fake profiles. Your conversion rate plummets while your cost per conversion skyrockets, making it harder to justify marketing spend. Your reporting and analytics become unreliable, and bad data leads to bad decisions.
In short, fake traffic poisons your performance metrics and makes it impossible to gauge true customer behavior. Without accurate data, your marketing and sales strategies suffer, and you end up wasting time, money, and resources chasing ghosts.
Channel saturation
A large-scale SMS pumping attack overwhelms your messaging infrastructure, clogging it with fake traffic. Your SMS provider gets overloaded, causing delays or even total service interruptions.
Real users trying to receive a login code, payment confirmation, or password reset are delayed or blocked entirely. This hits hardest at peak periods: promotional launches, high-traffic sales events, or security-critical moments like account recovery.
This results in frustrated users, abandoned carts, and dwindling trust in your brand.
Compliance and reputational damage
SMS pumping often runs alongside fake account creation- bot-generated accounts that pass phone verification and accumulate in your user base. Under KYC and AML frameworks, a verification flow that synthetic accounts can trivially pass creates compliance exposure.
Reputation damage is harder to quantify but compounds over time. Users whose accounts are delayed or disrupted during an attack lose trust in the platform, and the association with fraudulent activity, even as the victim, erodes brand credibility.
Fraud doesn’t just hurt your bottom line, it destroys trust. Whether it's customers or employees, once trust is broken, it’s incredibly difficult to rebuild.
Added operational costs
Dealing with the consequences of SMS pumping fraud doesn’t just eat into your financial resources. It will also make huge demands on your employees’ productivity because cybersecurity personnel will have their hands full fixing issues for every fraud victim.
They also have to investigate each fraudulent charge, manage justifiably irate customers, implement more robust security mechanisms for the future, and, if possible, trigger lawsuits against the fraudsters (if they can be identified).
How to Detect SMS Pumping Fraud
SMS pumping traffic is designed to look like legitimate user activity. These signals help distinguish fraudulent OTP traffic from real users:
Unusual spikes in OTP volume
If your OTP requests or SMS messages increase without a matching rise in legitimate user activity or a marketing campaign, it’s likely that fraudsters are behind it.
Traffic concentrated in specific geographies
If you notice a high volume of SMS messages being sent to countries where your business does not operate or have a significant customer base, it could be a sign of fraudsters exploiting your SMS services.
Sequential or patterned phone numbers
If the phone numbers requesting OTPs look suspiciously similar or follow sequential patterns (e.g., +1234567801, +1234567802, +1234567803), this isn’t just a coincidence.
Bots often use automated number lists to request OTPs, so spotting these patterns is a clear sign of SMS pumping fraud.
Requests routed through residential proxies
Residential proxies became the dominant attack infrastructure in 2025, used by attackers to distribute traffic and evade IP-based blocks (Prelude 2025 SMS Pumping Fraud Report)
Collapsing send-to-verify ratio
A ratio of OTP sends to code submissions above 2:1 is a strong indicator; fraudsters don't need to submit the code, they just need the message sent.
Therefore, if you notice a drop in conversion rate (overall or in a specific country), it’s a strong indicator that fraudulent traffic is inflating your user base without delivering real value. Prelude’s dashboard shows verification conversion rates globally and per country, so a drop in one market stands out quickly.
Customer complaints about delays
Fraudsters clogging your SMS system can cause delays for real users trying to receive their verification codes.
If your customer support team starts receiving complaints about slow OTP deliveries, your system may be overloaded with fake requests.
New account cohorts with near-zero engagement
If you start to notice sign-up spikes that don't translate into any downstream activity (logins, purchases, sessions) then you’re most likely being targeted by fraudsters.
SMS budget draining faster than expected
Your spend-to-activity ratio is the clearest lagging indicator; by the time it shows, damage has already occurred.
Most of these signals show up in real time. The last one only appears after the money is spent, which is why real-time detection matters.
How to Prevent SMS Pumping Fraud
Effective SMS pumping prevention requires both infrastructure hardening and real-time fraud detection before sending. Prelude Verify covers several of the controls below by default.
1.Add adaptive rate limiting
One of the most used ways to prevent SMS pumping fraud is by implementing rate limiting. This involves setting a cap on daily message volume or spending thresholds.
For instance, you could establish a policy that your SMS spend should never exceed $300 per day for OTP verifications and SMS-based authentications. This safeguard prevents you from getting hit with a shocking bill at the end of the month or year.
However, proceed with caution. While rate limiting can block fraudulent activity, it can also trigger false positives, preventing genuine users from completing their transactions, especially if your app experiences an unexpected surge in real traffic. Regular monitoring and adjusting limits in line with growth is key to striking the right balance between security and user experience.
Prelude Verify limits verification requests per phone number per time span, and teams can configure that limit from the dashboard.
2.Pre-send phone number classification
Before sending any OTP, evaluate the destination number for risk signals:
Number type: VoIP, virtual, and disposable numbers are significantly more likely to be used in pumping campaigns than established mobile numbers on major carriers. Flag or block sends to these number types.
Geographic risk: numbers in high-risk country codes or prefixes known to be associated with premium-rate fraud should trigger additional scrutiny or automatic blocking.
Recently activated numbers: numbers with very short activation histories are a common signal in bot-driven pumping campaigns.
3. Apply geographic restrictions
If your product does not operate in a given market, there is no legitimate reason to send OTPs there. Geo-restricting sends to your active markets is one of the fastest controls to implement and one of the most effective at reducing exposure to international premium-rate number fraud.
Be precise: broad country bans will frustrate legitimate users. Use your actual user geography data to define the allow-list.
In Prelude, each country has a fraud risk level that teams can raise or lower from the dashboard, so screening can be tightened in a risky market without blocking it outright.
4. Monitor Send-to-Verify Ratios
One of the strongest fraud indicators is a collapsing OTP verification rate as fraudulent traffic generates sends, not successful authentications.
Monitoring send-to-verify ratios in real time helps identify attacks early.
5.Leverage provider-level route intelligence
Work with an OTP provider that actively monitors and blocks fraud-prone routes. A provider that profits on per-message margin has a structural incentive not to block traffic. Look for transparent pricing with no per-message markup and an explicit commitment to route-level fraud management.
Prelude bills messages at carrier cost with zero markup, so blocking fraudulent traffic never cuts into its margin.
For a side-by-side look at the tools available, see our guide to SMS pumping solutions.
6. Use Real-Time Fraud Scoring
Static deny lists decay quickly. As a result, detection systems should evolve as attacker infrastructure changes.
Modern fraud prevention, therefore, requires:
Adaptive risk models
Behavioral intelligence
Continuously updated signals
Real-time decisioning
How Prelude Detects SMS Pumping Before the OTP Is Sent
Prelude’s approach to SMS pumping is detection before send, not detection after damage.
Prelude Verify screens every verification automatically. Before a code goes out, Verify’s machine learning anti-fraud system scores the request and blocks it if the risk is too high, so the message is never sent. When Verify blocks a request, it returns the risk factors behind the decision, including:
Temporary phone numbers: the number belongs to a disposable or short-lived numbering service.
Number range abuse: the number belongs to a range currently associated with abuse.
Poor conversion history: traffic resembling the request rarely completes a verification.
Location mismatch: the network location and the phone number’s country don’t match.
Proxy and IP signals: the request arrives through a proxy network, or from an IP address with a poor reputation or an unusual concentration of verifications.
Repeated attempts: the number exceeded the allowed verification attempts in a short period.
Fraud databases: the number is flagged in one or more of the fraud databases Prelude consults.
In Prelude’s 2025 dataset, machine-learning-based detection accounted for nearly 78% of all blocked fraud requests. Static rules can’t keep up with attackers who rotate IPs, cycle residential proxies, and mimic real-user timing.
Teams can tune this protection per country from the Prelude dashboard. They can raise or lower a region’s risk level and toggle rules such as VPN and proxy detection, without code changes.
Prelude Watch scores users at signup, whatever SMS provider you use. Watch returns a legitimate or suspicious verdict on the phone number or email a user signs up with. It draws on signals such as number portability history, residential proxies, disposable numbers, and IP and device discrepancies. Teams sending OTPs through another provider can use Watch to filter out suspicious signups before a send is triggered.
A real blocked attack
Here’s an example of an attack Prelude recently blocked for a European foodtech customer.
The attack originated from phone numbers registered in the United Kingdom, one of the markets in which the customer actively operates in. While the location wasn’t an immediate red flag, Prelude’s advanced algorithm flagged an anomaly: dozens of numbers within the same range were showing suspiciously low conversion rates.
Thanks to this early detection, Prelude was able to proactively block these numbers before the attack gained momentum. The fraudulent activity continued for several days, but as soon as the fraudsters realized it wasn’t succeeding, they abandoned the attack.
The volume of fraudulent messages blocked was nearly equivalent to the customer’s entire normal monthly traffic, saving them several thousand dollars that would have been lost to the attack.
With Prelude, you get proactive fraud prevention without disrupting the experience of real users.
If you’re ready to protect your business from SMS fraud, sign up for free and start testing Prelude’s API today.
What is SMS pumping fraud?
SMS pumping fraud, also known as Artificially Inflated Traffic (AIT) or SMS toll fraud, is when attackers flood OTP endpoints with bot requests to trigger large volumes of messages to premium-rate numbers they control, collecting a share of the termination fees your platform pays per message.
What is the difference between SMS pumping and IRSF?
SMS pumping is a form of IRSF. IRSF is the broader category and refers to any scheme that exploits telecom revenue-sharing to profit from message termination fees. SMS pumping is the specific variant that targets OTP and verification endpoints to drive that traffic. See What is IRSF? for a full breakdown of the attack.
How do I know if I'm a target of SMS pumping?
The clearest early signals are a collapsing send-to-verify ratio (many OTPs sent, very few codes submitted), traffic spikes concentrated in geographies with no real user base, and sequential or patterned phone numbers appearing in your OTP logs. A rising SMS bill without a corresponding increase in user activity is the most common way businesses first detect it but by then, damage has already occurred.
How does Prelude detect SMS pumping?
Prelude Verify scores every verification request before a code is sent, using machine learning and signals such as temporary phone numbers, abused number ranges, poor conversion history, location mismatches, and proxy traffic. High-risk requests are blocked, so the message is never sent. Prelude Watch adds a signup-time risk check that works with any SMS provider.
Can I just block entire countries to stop SMS pumping?
Geographic blocking is one useful control, but it should be precise rather than broad. Blocking entire countries risks cutting off legitimate users and losing real business.
The better approach is to restrict sends to your actual active markets based on real user geography data, and combine that with pre-send number classification and velocity monitoring for a layered defense.
If your app uses phone verification, you will most likely be a target of SMS pumping fraud at some point. Prelude's analysis of 205 million authentication requests in 2025 found that 11.83% of all verification traffic was fraudulent, with $3.26 million in SMS costs prevented across the dataset (Prelude 2025 SMS Pumping Fraud Report). Industry-wide, Juniper Research estimated that enterprise losses to artificially inflated traffic, the category SMS pumping belongs to, peaked at $2.1 billion in 2023.
SMS pumping is one of several OTP fraud types that exploit phone verification flows. Attackers exploit phone verification flows to generate SMS traffic to premium-rate numbers they control, forcing businesses to absorb the messaging costs. For the full landscape, see our Complete Guide to OTP Fraud.
In this guide, we’ll break down what SMS pumping fraud is, how it works, and most importantly, how to protect your business from this growing threat.
What is SMS Pumping?
SMS pumping is a type of fraud where attackers trigger large volumes of text messages to phone numbers they control, then collect a share of the fees each message generates. Most attacks target OTP and verification endpoints, because any form that sends an SMS when a phone number is submitted can be automated.
Fraudsters typically work with complicit mobile operators or intermediaries that pay out on terminated traffic. The business sending the messages pays for every one, so the financial damage lands on the victim.
Also known as SMS Toll Fraud or Artificially Inflated Traffic (AIT), SMS pumping is a variant of International Revenue Share Fraud (IRSF). The underlying mechanism is the same (exploiting telecom revenue-sharing agreements), but SMS pumping specifically targets your OTP and verification endpoints rather than traditional telecom infrastructure.
Unlike account takeover or credential stuffing attacks, the attacker’s goal is not to access user accounts or steal data.
The goal is much simpler: generate billable SMS traffic at scale. Prelude Verify is built to stop this before the first message goes out: it scores every verification request for fraud risk and blocks high-risk ones, so pumped numbers never receive a code.
How SMS Pumping Works
SMS pumping requires two things: access to a high-volume OTP endpoint and a relationship with a telecom route that pays out on traffic.
Step 1 - The attacker secures a revenue share. Fraudsters start by partnering with unethical carriers or gaining access to premium-rate numbers. They promise these operators high SMS volumes and increased revenue, using international premium-rate numbers (IPRNs) to drive traffic.
Step 2 - They identify a target point. Sign-up forms, login pages, password reset flows, and promotional redemption forms turn into targets- basically, any endpoint that triggers an SMS when a phone number is submitted.
Step 3 - Bots flood the endpoint. The fraudsters flood the system with SMS traffic, cycling through real-looking number formats in the target ranges. Your system sends OTP messages to those numbers. The fraudster collects a cut of the per-message fee. These SMS messages are routed to premium numbers controlled by the fraudsters, usually in foreign countries, inflating the cost for businesses that pay per message.
Step 4 - The damage stays hidden until the bill arrives. Every message that reaches the attacker’s numbers earns a termination fee, which the colluding carrier shares with the fraudsters. This is what makes SMS pumping particularly damaging. The traffic generates no failed logins, no suspicious access events, and no user complaints. Every message shows up as successfully delivered. The first sign is typically a billing anomaly, often days or weeks after the attack ran.
In short, both the scammers and their rogue partners profit from the fake SMS traffic, while the victim is left covering the costs.
Why OTP Systems are Particularly Vulnerable
SMS pumping works because OTP systems have a structural vulnerability built in by design: the send endpoint has to be public, the cost is absorbed by the platform, and success doesn’t require a real user on the other end.
In practice, this means that a sign up form or password reset flow has to accept requests from anyone. Unlike authenticated API endpoints that require a valid session or token, OTP send endpoints are open by nature. There is no credential to steal, no session to compromise. Any bot can trigger them.
Plus, verification flows tend to be predictable. Sign-up forms, password reset flows, and login pages follow consistent patterns in that they accept a phone number, trigger a send, and wait for a code submission, which means that bots can easily replicate this flow at scale.
The platforms, for their part, absorb the costs regardless of the outcome. Every message your system sends generates a charge, whether or not a real user requested it, whether or not the code is ever submitted, and whether or not the phone number even exists. In other words, they bear the entire cost of every request, fraudulent or not.
Furthermore, telecom billing creates a direct revenue model for attackers. The global SMS routing system was built on carrier settlement agreements. Fraudsters insert themselves into this system by acquiring or partnering with number ranges that generate a payout on termination. Every OTP your system sends to those numbers puts money in the attacker's pocket. There is no equivalent mechanism in most other fraud types; SMS pumping is one of the few attacks where the infrastructure of the victim's own provider directly funds the attacker.
This type of fraud can unleash some major damage because many applications lack capabilities such as device intelligence, behavioral analysis, carrier risk scoring, adaptive rate limiting and fraud-aware verification controls.This creates an environment where attackers can generate massive OTP traffic with very little resistance.
The only defense that can reliably address SMS pumping before it inflicts damage is actually evaluating the destination number before sending, which many OTP implementations don’t do.
SMS Pumping Examples
The fintech app: Promo campaign gone wrong
A fintech app launches a referral campaign: a user invites a friend, both accounts get $80 in credit. To claim the reward, the referred user just needs to sign up and verify their phone number.
Within 48 hours of the campaign launch, the OTP send volume is 40 times the expected rate. Bots are hammering the sign-up endpoint with thousands of phone numbers per hour, all routed to premium-rate ranges the attacker controls. The referral mechanic doesn't even matter; the attackers aren't after the $80 credit. They're after the OTP messages themselves. Most of the "new accounts" created during the attack show zero activity and are never used again.
Because the messages appear successfully delivered, the attack goes undetected until billing alerts trigger days later. The first signal was the bill.
The business: Fake signups at scale
Consider a subscription retailer that offers customers 15% off their first subscription in exchange for entering their phone number on the website.
Once a customer enters their phone number, the company sends an SMS with a discount code. It’s a simple strategy to boost signups from interested customers.
But fraudsters see an opportunity. They use bots to flood the website with thousands of fake phone numbers. Each number triggers an SMS that is routed to a premium-rate number controlled by the scammers.
The company ends up with a huge bill for all those SMS messages but no real customers. Every text they sent went to fraudulent numbers, benefiting the scammers. Every message went to a fraudulent number that was never going to convert.
Because the traffic passes through several networks before reaching its destination, businesses rarely find out who is behind an attack. That’s why prevention has to happen before the message is sent.
The platform: $60M/year in fake 2FA traffic
Even the largest platforms with significant engineering resources are not immune. Elon Musk publicly reported in 2023 that Twitter was being charged approximately $60 million per year for fake 2FA SMS messages generated by telecom fraud schemes, which illustrates how quickly SMS pumping scales when left undetected.
How SMS Pumping Fraud hurts Your Business
SMS fraud is widespread and can impact businesses in many ways:
Direct financial loss
This is the most immediate impact. Fraudulent SMS traffic leads to massive financial hits. Since businesses pay for every SMS they send, scammers can exploit this to drive up costs by routing messages to premium numbers they control.
Every fraudulent OTP send is a real charge. Your platform pays per message, and attackers will exploit that for as long as they can. Attacks also arrive in bursts. In May 2025, Prelude blocked 763,212 fraudulent requests in a single attack targeting Nigerian numbers (Prelude 2025 SMS Pumping Fraud Report).
Unlike most fraud, SMS pumping losses are rarely recoverable. By the time the bill arrives, the messages have already been sent and the fees charged.
That’s why having strong promotion abuse prevention tools in place, like real-time monitoring and automatic blocking, is essential to protect both your users and your budget.
Platform Abuse and Fake Account Growth
SMS pumping rarely happens in isolation.
The same infrastructure used to generate fraudulent OTP traffic is often used for fake account creation, referral abuse, spam campaigns, synthetic onboarding, and promotion abuse.
As fraudulent accounts accumulate, moderation, compliance, and trust problems grow across the platform.
Metric pollution and bad data
SMS pumping generates fake accounts at scale. Your sign-up numbers, DAU, MAU, and cohort data all get inflated with users who don't exist.
Your user base gets inflated with fake profiles. Your conversion rate plummets while your cost per conversion skyrockets, making it harder to justify marketing spend. Your reporting and analytics become unreliable, and bad data leads to bad decisions.
In short, fake traffic poisons your performance metrics and makes it impossible to gauge true customer behavior. Without accurate data, your marketing and sales strategies suffer, and you end up wasting time, money, and resources chasing ghosts.
Channel saturation
A large-scale SMS pumping attack overwhelms your messaging infrastructure, clogging it with fake traffic. Your SMS provider gets overloaded, causing delays or even total service interruptions.
Real users trying to receive a login code, payment confirmation, or password reset are delayed or blocked entirely. This hits hardest at peak periods: promotional launches, high-traffic sales events, or security-critical moments like account recovery.
This results in frustrated users, abandoned carts, and dwindling trust in your brand.
Compliance and reputational damage
SMS pumping often runs alongside fake account creation- bot-generated accounts that pass phone verification and accumulate in your user base. Under KYC and AML frameworks, a verification flow that synthetic accounts can trivially pass creates compliance exposure.
Reputation damage is harder to quantify but compounds over time. Users whose accounts are delayed or disrupted during an attack lose trust in the platform, and the association with fraudulent activity, even as the victim, erodes brand credibility.
Fraud doesn’t just hurt your bottom line, it destroys trust. Whether it's customers or employees, once trust is broken, it’s incredibly difficult to rebuild.
Added operational costs
Dealing with the consequences of SMS pumping fraud doesn’t just eat into your financial resources. It will also make huge demands on your employees’ productivity because cybersecurity personnel will have their hands full fixing issues for every fraud victim.
They also have to investigate each fraudulent charge, manage justifiably irate customers, implement more robust security mechanisms for the future, and, if possible, trigger lawsuits against the fraudsters (if they can be identified).
How to Detect SMS Pumping Fraud
SMS pumping traffic is designed to look like legitimate user activity. These signals help distinguish fraudulent OTP traffic from real users:
Unusual spikes in OTP volume
If your OTP requests or SMS messages increase without a matching rise in legitimate user activity or a marketing campaign, it’s likely that fraudsters are behind it.
Traffic concentrated in specific geographies
If you notice a high volume of SMS messages being sent to countries where your business does not operate or have a significant customer base, it could be a sign of fraudsters exploiting your SMS services.
Sequential or patterned phone numbers
If the phone numbers requesting OTPs look suspiciously similar or follow sequential patterns (e.g., +1234567801, +1234567802, +1234567803), this isn’t just a coincidence.
Bots often use automated number lists to request OTPs, so spotting these patterns is a clear sign of SMS pumping fraud.
Requests routed through residential proxies
Residential proxies became the dominant attack infrastructure in 2025, used by attackers to distribute traffic and evade IP-based blocks (Prelude 2025 SMS Pumping Fraud Report)
Collapsing send-to-verify ratio
A ratio of OTP sends to code submissions above 2:1 is a strong indicator; fraudsters don't need to submit the code, they just need the message sent.
Therefore, if you notice a drop in conversion rate (overall or in a specific country), it’s a strong indicator that fraudulent traffic is inflating your user base without delivering real value. Prelude’s dashboard shows verification conversion rates globally and per country, so a drop in one market stands out quickly.
Customer complaints about delays
Fraudsters clogging your SMS system can cause delays for real users trying to receive their verification codes.
If your customer support team starts receiving complaints about slow OTP deliveries, your system may be overloaded with fake requests.
New account cohorts with near-zero engagement
If you start to notice sign-up spikes that don't translate into any downstream activity (logins, purchases, sessions) then you’re most likely being targeted by fraudsters.
SMS budget draining faster than expected
Your spend-to-activity ratio is the clearest lagging indicator; by the time it shows, damage has already occurred.
Most of these signals show up in real time. The last one only appears after the money is spent, which is why real-time detection matters.
How to Prevent SMS Pumping Fraud
Effective SMS pumping prevention requires both infrastructure hardening and real-time fraud detection before sending. Prelude Verify covers several of the controls below by default.
1.Add adaptive rate limiting
One of the most used ways to prevent SMS pumping fraud is by implementing rate limiting. This involves setting a cap on daily message volume or spending thresholds.
For instance, you could establish a policy that your SMS spend should never exceed $300 per day for OTP verifications and SMS-based authentications. This safeguard prevents you from getting hit with a shocking bill at the end of the month or year.
However, proceed with caution. While rate limiting can block fraudulent activity, it can also trigger false positives, preventing genuine users from completing their transactions, especially if your app experiences an unexpected surge in real traffic. Regular monitoring and adjusting limits in line with growth is key to striking the right balance between security and user experience.
Prelude Verify limits verification requests per phone number per time span, and teams can configure that limit from the dashboard.
2.Pre-send phone number classification
Before sending any OTP, evaluate the destination number for risk signals:
Number type: VoIP, virtual, and disposable numbers are significantly more likely to be used in pumping campaigns than established mobile numbers on major carriers. Flag or block sends to these number types.
Geographic risk: numbers in high-risk country codes or prefixes known to be associated with premium-rate fraud should trigger additional scrutiny or automatic blocking.
Recently activated numbers: numbers with very short activation histories are a common signal in bot-driven pumping campaigns.
3. Apply geographic restrictions
If your product does not operate in a given market, there is no legitimate reason to send OTPs there. Geo-restricting sends to your active markets is one of the fastest controls to implement and one of the most effective at reducing exposure to international premium-rate number fraud.
Be precise: broad country bans will frustrate legitimate users. Use your actual user geography data to define the allow-list.
In Prelude, each country has a fraud risk level that teams can raise or lower from the dashboard, so screening can be tightened in a risky market without blocking it outright.
4. Monitor Send-to-Verify Ratios
One of the strongest fraud indicators is a collapsing OTP verification rate as fraudulent traffic generates sends, not successful authentications.
Monitoring send-to-verify ratios in real time helps identify attacks early.
5.Leverage provider-level route intelligence
Work with an OTP provider that actively monitors and blocks fraud-prone routes. A provider that profits on per-message margin has a structural incentive not to block traffic. Look for transparent pricing with no per-message markup and an explicit commitment to route-level fraud management.
Prelude bills messages at carrier cost with zero markup, so blocking fraudulent traffic never cuts into its margin.
For a side-by-side look at the tools available, see our guide to SMS pumping solutions.
6. Use Real-Time Fraud Scoring
Static deny lists decay quickly. As a result, detection systems should evolve as attacker infrastructure changes.
Modern fraud prevention, therefore, requires:
Adaptive risk models
Behavioral intelligence
Continuously updated signals
Real-time decisioning
How Prelude Detects SMS Pumping Before the OTP Is Sent
Prelude’s approach to SMS pumping is detection before send, not detection after damage.
Prelude Verify screens every verification automatically. Before a code goes out, Verify’s machine learning anti-fraud system scores the request and blocks it if the risk is too high, so the message is never sent. When Verify blocks a request, it returns the risk factors behind the decision, including:
Temporary phone numbers: the number belongs to a disposable or short-lived numbering service.
Number range abuse: the number belongs to a range currently associated with abuse.
Poor conversion history: traffic resembling the request rarely completes a verification.
Location mismatch: the network location and the phone number’s country don’t match.
Proxy and IP signals: the request arrives through a proxy network, or from an IP address with a poor reputation or an unusual concentration of verifications.
Repeated attempts: the number exceeded the allowed verification attempts in a short period.
Fraud databases: the number is flagged in one or more of the fraud databases Prelude consults.
In Prelude’s 2025 dataset, machine-learning-based detection accounted for nearly 78% of all blocked fraud requests. Static rules can’t keep up with attackers who rotate IPs, cycle residential proxies, and mimic real-user timing.
Teams can tune this protection per country from the Prelude dashboard. They can raise or lower a region’s risk level and toggle rules such as VPN and proxy detection, without code changes.
Prelude Watch scores users at signup, whatever SMS provider you use. Watch returns a legitimate or suspicious verdict on the phone number or email a user signs up with. It draws on signals such as number portability history, residential proxies, disposable numbers, and IP and device discrepancies. Teams sending OTPs through another provider can use Watch to filter out suspicious signups before a send is triggered.
A real blocked attack
Here’s an example of an attack Prelude recently blocked for a European foodtech customer.
The attack originated from phone numbers registered in the United Kingdom, one of the markets in which the customer actively operates in. While the location wasn’t an immediate red flag, Prelude’s advanced algorithm flagged an anomaly: dozens of numbers within the same range were showing suspiciously low conversion rates.
Thanks to this early detection, Prelude was able to proactively block these numbers before the attack gained momentum. The fraudulent activity continued for several days, but as soon as the fraudsters realized it wasn’t succeeding, they abandoned the attack.
The volume of fraudulent messages blocked was nearly equivalent to the customer’s entire normal monthly traffic, saving them several thousand dollars that would have been lost to the attack.
With Prelude, you get proactive fraud prevention without disrupting the experience of real users.
If you’re ready to protect your business from SMS fraud, sign up for free and start testing Prelude’s API today.
What is SMS pumping fraud?
SMS pumping fraud, also known as Artificially Inflated Traffic (AIT) or SMS toll fraud, is when attackers flood OTP endpoints with bot requests to trigger large volumes of messages to premium-rate numbers they control, collecting a share of the termination fees your platform pays per message.
What is the difference between SMS pumping and IRSF?
SMS pumping is a form of IRSF. IRSF is the broader category and refers to any scheme that exploits telecom revenue-sharing to profit from message termination fees. SMS pumping is the specific variant that targets OTP and verification endpoints to drive that traffic. See What is IRSF? for a full breakdown of the attack.
How do I know if I'm a target of SMS pumping?
The clearest early signals are a collapsing send-to-verify ratio (many OTPs sent, very few codes submitted), traffic spikes concentrated in geographies with no real user base, and sequential or patterned phone numbers appearing in your OTP logs. A rising SMS bill without a corresponding increase in user activity is the most common way businesses first detect it but by then, damage has already occurred.
How does Prelude detect SMS pumping?
Prelude Verify scores every verification request before a code is sent, using machine learning and signals such as temporary phone numbers, abused number ranges, poor conversion history, location mismatches, and proxy traffic. High-risk requests are blocked, so the message is never sent. Prelude Watch adds a signup-time risk check that works with any SMS provider.
Can I just block entire countries to stop SMS pumping?
Geographic blocking is one useful control, but it should be precise rather than broad. Blocking entire countries risks cutting off legitimate users and losing real business.
The better approach is to restrict sends to your actual active markets based on real user geography data, and combine that with pre-send number classification and velocity monitoring for a layered defense.
Start optimizing your auth flow
Send verification text-messages anywhere in the world with the best price, the best deliverability and no spam.
