SMS pumping, also called artificially inflated traffic (AIT), is a fraud in which bots trigger large numbers of OTP requests to numbers controlled by third parties. The goal is not to break into any account: it is to generate messages that someone in the chain gets paid for. The company that owns the form pays the bill.
How it works
- The attacker finds a public form that sends SMS: sign-up, login, password recovery or “text me a link”.
- A bot fills in the form with thousands of numbers, often sequential or in destinations unusual for the business.
- Each request generates an SMS. The codes are never used, but the messages are billed.
Ericsson describes AIT as SMS traffic generated for the fraudulent purpose of generating revenue, and notes the problem has grown exponentially in recent years.
Warning signs
- Spikes in OTP requests without a matching increase in completed sign-ups or logins.
- A sharp drop in the verification rate: many codes sent, very few validated.
- Sequential numbers or repeated patterns.
- Requests to countries or prefixes your business does not serve.
- Many requests from a few IPs, devices or user agents.
Controls that work
| Control | What it does |
|---|---|
| Limits per number, IP and device | Caps how many codes can be requested in a time window |
| Challenge on public forms | A CAPTCHA or behavioral check before sending the code |
| Allowed destinations list | Blocks countries or prefixes your service does not serve |
| Resend with progressive delay | Prevents one number from receiving dozens of codes in a row |
| Verification-rate monitoring | Alerts when validated codes drop relative to codes sent |
| Number pre-validation | Discards invalid formats or landlines before sending |
These controls are also in line with NIST’s authentication guidelines, which recommend throttling attempts and monitoring abnormal behavior when SMS codes are used.
What the sending platform adds
The first line of defense is your application, because only it knows whether a request is legitimate. The messaging platform complements it with visibility: real-time delivery reports to spot spikes, blacklists to block abusive numbers and validation of each number against Mexico’s National Numbering Plan to tell mobiles from landlines. Talk to our team to review your code flow.
Sources
- “AIT: The root cause, the solution and the implication on RCS and Network APIs”, Ericsson, February 28, 2025. Read source
- “NIST SP 800-63B-4: Digital Identity Guidelines — Authentication and Authenticator Management”, NIST, 2025. Read source
