SMS Pumping: When Bots Request Your Verification Codes
Contents
SMS pumping is fraud against the company that sends verification codes. Bots enter phone numbers from expensive ranges into a sign-up or login form, the company pays to send a code to each one, and part of that payment flows back to the people running the bots through a share of the termination fees. Nobody ever enters the codes. The attack shows up as a jump in SMS spend, codes sent to countries you have no customers in, and a falling share of codes that get verified.
How does SMS pumping work?
Every text a company sends costs a fee, and most of it goes to the mobile network that delivers the message. In some countries that termination fee is many times the price of a text in the US or Western Europe. Pumping profits from that difference.
- The operator arranges a revenue share with someone who can collect termination fees on a block of numbers, such as a small carrier or an intermediary on the route.
- Bots find a form that sends SMS on demand. Sign-up, login, password reset and “send me the app link” forms all qualify.
- The bots submit numbers from that block, often in sequence, from many IP addresses, at a steady rate or in bursts.
- Your SMS provider delivers each code and bills you. The fee passes along the route, and the share agreed in step 1 goes to the fraudster.
- The codes are never entered. No account is ever created.
The industry calls this artificially inflated traffic, and SMS pumping is the common name for it. It differs from SMS bombing, where the goal is to flood one person’s phone with codes. Pumping targets your invoice, and the numbers are chosen for what they cost you.
How much can it cost?
The best-known example came from Twitter in 2023. Elon Musk said the company was losing about $60 million a year to fake two-factor SMS traffic, and the same month Twitter announced that text-message two-factor authentication would be limited to paying Twitter Blue subscribers from March 20. At a smaller company the first sign is often an SMS bill several times the usual, with the extra spend concentrated in a few countries.
What does an attack look like in your logs?
| Signal | Normal traffic | Pumping |
|---|---|---|
| Conversion rate (codes verified ÷ codes sent) | Stable and high | Drops sharply, often to near zero for the attacked countries |
| Destination countries | Match your customers | Countries you do not serve, or a sudden spike in one |
| Number patterns | Random | Sequential numbers in one range, same prefix repeating |
| Request rhythm | Follows your daily traffic | Steady machine rate, or bursts at odd hours |
| Sessions | Requests come from people moving through the app | Code requests with no other activity in the session |
Conversion rate is the most useful single number. Track it per country and alert when it falls. A country where hundreds of codes go out and almost none come back is either broken delivery or pumping, and both need someone to look at it.
How do you stop it?
Combine several controls, because each one leaves a gap.
- Allow only the countries you serve. SMS providers let you switch off destination countries; Twilio calls these geo permissions. If you have no customers in a country, nothing should be sent there.
- Rate-limit by number, by prefix and by IP. One number rarely needs more than a few codes an hour, and a block of sequential numbers should never get a code each.
- Put friction before the send. Show the code request only after the user has done something a bot finds costly, such as passing a CAPTCHA or completing an email step. Send the SMS last.
- Slow down resends. Grow the wait between resend requests, for example 30 seconds, then 60, then several minutes.
- Watch conversion per country and pause sending to any country that drops below your threshold until someone checks it.
- Use the fraud controls your provider offers. Several verification APIs block numbers and prefixes with a history of pumping before the message goes out.
- Offer a channel that costs nothing to send, such as an authenticator app, an email code or a passkey, so fewer logins depend on SMS at all.
Check what each control does to real users before you turn it on. A country block that cuts off travelling customers, or a CAPTCHA that fails on old phones, costs sign-ups too.
How do you test the controls without real users?
You need real numbers in real countries to see what a user sees: whether the code arrives, how long it takes, and whether your new limits block a legitimate second attempt. Rented numbers cover that. The API requests a number in a chosen country, polls for the code your app sends and releases the number when the test ends, so a test run can confirm that your country allow-list and resend timers behave as intended from the receiving side. The OTP testing handbook covers how to structure those runs, and how a one-time code reaches your phone explains the route a code takes between your provider and the handset.
Common questions
Is SMS pumping illegal?
The fraudsters’ side involves deception to collect fees, and it breaks SMS providers’ acceptable-use terms. For the company being targeted, the practical question is the bill. Providers bill pumped messages like any other delivered SMS, and any refund is at their discretion, so prevention matters more than disputes.
Does a CAPTCHA stop SMS pumping on its own?
No. Some operators pay services that solve CAPTCHAs, so it raises the cost per attack without closing the gap. Combined with country restrictions and rate limits, it cuts the number of codes the bots can trigger.
Can my own phone number be used in an SMS pumping attack?
Pumping uses numbers whose termination fees the fraudster collects, so ordinary personal numbers are rarely involved. A flood of codes to your own phone from many services is more likely SMS bombing, which a verification code you did not request covers.