What is SMS pumping (artificially inflated traffic)?
SMS pumping — artificially inflated traffic (AIT) — is fraud where bots trigger your OTP sends to attacker-controlled number ranges that pay them per message. Detection: destination analytics.
Definition
SMS pumping, formally artificially inflated traffic (AIT), is a revenue- share fraud against anyone who sends verification SMS. The attacker controls or profits from termination on a range of mobile numbers — via a complicit or compromised route — and then uses bots to hammer a victim’s signup or login form with those numbers. Every OTP the victim dutifully sends generates termination revenue that flows back to the attacker. The victim’s only symptom is an SMS bill that grew 10× with zero new real users.
The pattern is detectable because pumped traffic is statistically absurd: bursts of verification requests to consecutive or same-prefix numbers, destination countries your product has no users in, conversion rates near zero (codes requested, never entered), and requests arriving at bot cadence. Defences layer: rate-limit sends per number, prefix, and IP; block or challenge destinations with no legitimate user base; check numbers against reputation data before sending; and watch request-to-conversion ratios per prefix in near-real time. Industry estimates put AIT losses in the billions of messages per year.
Why it matters
AIT is the fraud most likely to hit any product with SMS verification — it needs no breach, just your public signup form. A conversion-rate alarm per destination prefix costs an afternoon to build and stops the bill-shock version of the attack almost completely.
See it in action
See live AIT patterns in the OTP fraud report →