What Is SMS Pumping Fraud and How to Stop It

Summary

SMS pumping fraud, also called SMS toll fraud, uses bots and fake phone numbers to trigger automated text messages from public-facing endpoints, leaving businesses to pay for traffic that produces no genuine customers. The attack can target OTP requests, sign-up and lead forms, transactional notifications, marketing campaigns, and chatbot endpoints; it may appear as a sudden spike or as distributed low-volume traffic that accumulates over days or weeks. Suggested detection measures include monitoring traffic by use case and geography, reconciling spend with conversions, examining clustered phone-number patterns, and analyzing incomplete forms. The prevention guidance covers CAPTCHA, behavioral bot detection, rate limits, geographic controls, delayed OTP requests, alternative verification methods, and Twilio products including Verify Fraud Guard, SMS Pumping Protection, and Lookup SMS Pumping Risk Score.

Takeaways

1. 1

   Attackers can use bots to submit fake phone numbers to any public-facing endpoint that triggers an automated SMS, causing the business to pay for messages that do not produce genuine customers.

2. 2

   SMS pumping may present as a sudden high-volume spike or as distributed low-volume traffic that blends into normal activity and accumulates costs over days or weeks.

3. 3

   Verify Fraud Guard automatically blocks suspected destination prefixes after analyzing current and historical SMS traffic; the post says it saved Twilio customers $62.7 million in fraudulent costs between June 2022 and October 2024.