State of OTP fraud

Live aggregates from the SMS-24 phone-reputation corpus: 1,751,149 OTP messages observed across 83 countries, with the top abusive services and 30-day trend. Free to cite — attribution: SMS-24.

Headline numbers

30-day message-volume trend

Top OTP-receiving services (by message volume)

Top countries by message volume

How to cite

This report is published under CC BY 4.0. Suggested citation:

SMS-24, "State of OTP fraud" (continuously updated). https://sms-24.net/data/otp-fraud-report — snapshot 2026-09-01.

Methodology

• Source: The SMS-24 scraper indexes 55+ public SMS-receive websites continuously. Every observed OTP message lands in our PostgreSQL/TimescaleDB messages hypertable.
• Aggregation cadence: The numbers on this page are recomputed every 30 minutes from the production database by the seo_stats_aggregator task and cached in Redis.
• Service classification: The service_name column is filled by our processor pipeline that runs sender-fingerprint + body-pattern classification. Unknown senders are excluded from the top-services chart.
• Country mapping: Country code derived from the E.164 prefix at ingest, not from sender geo — so the chart shows where the OTPs land, not where the senders are.
• Bias: Public SMS-receive sites over-represent disposable-number traffic. Treat these volumes as upper bounds on observable abuse, not absolute industry rates.

What's adjacent

• Enterprise pitch — SMPP, HLR, 0–100 rating, registration intel
• Per-country phone profile (242 countries)
• Public MCC/MNC database
• Free phone-reputation demo

Last refreshed: 2026-09-01T17:05:37.662743+00:00