# SMS pumping

> SMS pumping is fraud in which bots trigger OTP or sign-up texts to numbers that earn the attacker a share of the fees. How it works and how to reduce it.

Canonical: https://mobilevalidate.com/glossary/sms-pumping · Last updated: 2026-09-25

![A shield and a risk gauge pointing into the high range, with an incoming call flagged as risky.](https://mobilevalidate.com/images/spam-reputation-risk-score.svg)

*Spam reputation gives a risk level and the reasons behind it, where the service is enabled.*


SMS pumping is a type of fraud in which an attacker makes a business send large numbers of text messages, usually one-time passcodes or sign-up confirmations, to phone numbers that earn the attacker money for every message delivered. The industry also calls it SMS toll fraud or artificially inflated traffic (AIT).

## How does SMS pumping work?

Every SMS generates fees along its route. The sender pays its messaging provider, which pays the networks that carry and terminate the message. In an SMS pumping scheme, the attacker controls, or has a revenue-share deal with, part of that chain, typically for a block of numbers in a high-cost destination.

The attacker then uses bots to enter those numbers into forms that send an SMS automatically: "send me a code", "sign up", "reset password". Every message costs the business money and pays part of that fee to the attacker. The numbers are often sequential or drawn from a small set of ranges, and nobody ever enters the codes.

## How big is the problem?

Large platforms have reacted publicly: in March 2023 Twitter (now X) restricted SMS-based two-factor authentication to paying subscribers, citing abuse of SMS verification. For smaller companies the damage usually shows up as a sudden SMS bill spike from countries where they have few customers.

## What are the warning signs?

- A surge of OTP or sign-up requests with **no matching completions**: codes are sent but never entered.
- Traffic concentrated on **one country or a few number ranges** outside your normal markets.
- **Sequential or near-sequential numbers**, such as +…001, +…002 and so on.
- Requests to **non-mobile line types**: premium-rate, shared-cost, or [VoIP](/glossary/voip-number) ranges you normally don't see.
- Bursts at odd hours, from rotating IP addresses or unusual user agents.

## How can you reduce SMS pumping?

No single control stops it. Several layers together work better:

1. **Check the number before you send.** A [carrier lookup](/services/carrier-lookup) shows the [line type](/glossary/line-type). Don't send OTP texts to premium-rate, toll-free or fixed-line numbers.
2. **Allow only the countries you serve.** Block or add friction for OTP to destinations where you have no customers.
3. **Prefer channels with evidence of real use.** If a number has a [WhatsApp](/services/whatsapp-number-check) or [Telegram](/services/telegram-number-check) account and the user agreed to receive codes there, delivering there doesn't generate an SMS termination fee.
4. **Rate-limit per number, IP address, device and session**, and cap total daily OTP spend.
5. **Use bot protection** on public forms (a challenge or proof-of-work before the SMS is sent).
6. **Watch the conversion rate** of codes sent to codes verified, per country, and alert on drops.

## How does MobileValidate help?

MobileValidate checks the number itself before you pay for an SMS: line type and carrier, channel registrations, and (for US, CA and DE) [spam reputation](/services/spam-reputation). Unknown answers are free. The API also refuses requests that look like sequential number ranges, the same pattern pumping bots use. See the [OTP and sign-up fraud](/use-cases/otp-and-signup-fraud) use case for a worked example.

## Frequently asked questions

### Who pays for SMS pumping?

The business whose form sends the messages. It pays its SMS provider for every text, and part of that money ends up with whoever controls the destination numbers.

### Why are one-time passcode forms the main target?

They send an SMS to any number typed in, often without a login, a payment or a CAPTCHA. A bot can trigger thousands of messages quickly.

### Does checking numbers before sending stop SMS pumping?

It reduces it. Filtering out non-mobile line types, unsupported countries and numbers with no sign of real use removes many pumped destinations before any SMS fee is paid. Combine it with rate limits and bot protection.