Twilio
SMS pumping fraud, also called SMS toll fraud, uses bots and fake phone numbers to trigger automated text messages from public-facing endpoints, leaving businesses to pay for traffic that produces no genuine customers. The attack can target OTP requests, sign-up and lead forms, transactional notifications, marketing campaigns, and chatbot endpoints; it may appear as a sudden spike or as distributed low-volume traffic that accumulates over days or weeks. Suggested detection measures include monitoring traffic by use case and geography, reconciling spend with conversions, examining clustered phone-number patterns, and analyzing incomplete forms. The prevention guidance covers CAPTCHA, behavioral bot detection, rate limits, geographic controls, delayed OTP requests, alternative verification methods, and Twilio products including Verify Fraud Guard, SMS Pumping Protection, and Lookup SMS Pumping Risk Score.