Skip to content

SMS Pumping (Artificially Inflated Traffic)(AIT)

Also called: SMS pumping · SMS pumping fraud · Artificially inflated traffic · SMS toll fraud · OTP pumping

Definition
Fraud in which bots trigger OTP or sign-up SMS to number ranges whose termination revenue the fraudsters share, inflating the sender's bill.

Exhibit A

Spot the attack in a week of OTP traffic

Tuesday · 02:00

100

OTP SMS sent per hour, IST (illustrative, scaled 0–100)

Peak
Tue 02:00
100
Busiest day
Tuesday
avg 43
Best hour
20:00
avg 59

Genuine demand peaks in the evening. The 00:00–05:00 blocks on Tuesday, Thursday and Sunday are pumping: one foreign prefix, sequential numbers, almost no codes entered.

0100Peak hourBest hour on average

Focus the grid and use the arrow keys (Home / End for 00:00 / 23:00), or point at a cell.

An illustrative week of OTP sends by day and hour (IST). Daytime demand follows real users; the hot blocks after midnight on three nights are pumping bursts. Hover or tab through the cells.

What is SMS pumping?

SMS pumping, also called artificially inflated traffic (AIT) or SMS toll fraud, is an attack on businesses that send SMS on demand, above all SMS OTP flows. A fraudster points bots at any form that triggers a text (sign-up, login OTP, password reset, "send me the app link") and makes it send thousands of messages to numbers in ranges they profit from. Every message is billed to the business, and somewhere along the chain a party that collects termination fees on those ranges shares the revenue with the fraudster.

The numbers are usually not real customers. They are often sequential numbers within one prefix, frequently in a country the business does not serve, and nobody ever enters the codes. That gives the attack its signature: a sudden rise in SMS to an unusual country or prefix, often at night in the business's own time zone, with a verification (conversion) rate close to zero. Because each request looks like a legitimate OTP, the gateway delivers them faithfully, and the first sign is often the invoice.

It is different from neighbouring problems. A brute-force attack guesses codes to break into accounts; pumping does not care about the code, only the sending. A grey route cheats carriers by sneaking traffic past termination fees; pumping exploits those fees against the sender. In India, domestic OTPs run on DLT-registered templates, but DLT checks the sender and wording, not whether a real person asked for the code, so most attacks aim at international destinations through your own forms.

Key takeaways

  • SMS pumping is fraud in which bots request OTP or sign-up SMS to numbers whose termination fees the fraudsters share.
  • The sender pays for every pumped message; nobody ever enters a code, so the verification rate on the targeted range collapses.
  • The fastest single defence is a country allowlist: never send SMS to destinations you do not serve.
  • Rate limits per number, prefix, IP and device plus a conversion-based circuit breaker stop most remaining attacks.
  • Pumping cheats the sender; a grey route cheats carriers. Both hide in low-quality SMS traffic but need different fixes.

How does SMS pumping work?

  1. Fraudster lines up the revenue

    They arrange to share termination fees on a block of numbers, typically in a high-cost destination, through a party in the delivery chain that is paid per terminated SMS.

  2. Bots find your SMS trigger

    Scripts or headless browsers submit your sign-up, OTP or password-reset form with numbers from that block, rotating IPs and devices to look like many users.

  3. Your system sends and pays

    Each request passes basic validation, so your gateway sends a real SMS and bills you for it. Thousands of requests per hour become thousands of billed segments.

  4. Nobody verifies

    No code is ever entered. The tell-tale pattern is high volume to one country or prefix with a verification rate near zero, often outside your normal traffic hours.

  5. You cut it off in layers

    Block countries you do not serve, throttle per number, prefix, IP and device, trip a circuit breaker when conversion collapses, and move verification to channels without termination revenue.

Example: A Bengaluru fintech's overnight spike

Between 01:00 and 04:00 IST, a Bengaluru lending app sends 38,000 sign-up OTPs to numbers in one foreign prefix, nearly all sequential, and 0.4% are verified. Its normal daytime OTP conversion is 78%. The team switches on a country allowlist (India plus the one Gulf market where it serves non-resident customers), caps OTPs at three per number per hour and 200 per prefix per hour, and pauses SMS to any prefix whose hourly conversion falls under 20% after 100 sends. The next night's attempt is stopped at the form after 12 messages.

Common mistakes with SMS pumping

  • Allowing every country by default

    Most attacks target destinations the business never serves. Start from an allowlist of your real markets and add countries deliberately, each with a daily budget.

  • Rate-limiting only per phone number

    Attackers use a different number for every request. Limit per IP, device, session and number prefix as well, and keep a global hourly budget per country.

  • Watching volume instead of conversion

    A busy sale day also raises volume. The reliable signal is codes verified divided by codes sent, per country and prefix; alert when it falls well below your baseline.

  • Switching SMS off entirely

    Blocking all OTPs locks out genuine users. Pause only the affected prefixes or countries and offer another verification channel while the attack runs.

SMS pumping in code

import { parsePhoneNumberFromString } from "libphonenumber-js";
 
const ALLOWED = new Set(["IN", "AE"]);           // countries you actually serve
const LIMITS = { number: 3, ip: 10, prefix: 200 }; // per hour
 
async function hit(key, limit) {
  const n = await redis.incr(key);
  if (n === 1) await redis.expire(key, 3600);
  return n <= limit;
}
 
export async function canSendOtp(phone, ip) {
  const p = parsePhoneNumberFromString(phone);
  if (!p?.isValid() || !ALLOWED.has(p.country)) return { ok: false, why: "geo" };
  const prefix = p.number.slice(0, 7);             // e.g. +91 plus first digits
  if (await redis.get(`breaker:${prefix}`)) return { ok: false, why: "breaker" };
  const ok = (await hit(`otp:n:${p.number}`, LIMITS.number))
    && (await hit(`otp:ip:${ip}`, LIMITS.ip))
    && (await hit(`otp:p:${prefix}`, LIMITS.prefix));
  return ok ? { ok: true } : { ok: false, why: "rate" };
}
 
// Run every few minutes: trip the breaker when nobody verifies.
export async function checkConversion(prefix, sent, verified) {
  if (sent >= 100 && verified / sent < 0.2) {
    await redis.set(`breaker:${prefix}`, "1", "EX", 3600);
    alertOps(`OTP conversion ${verified}/${sent} on ${prefix}: SMS paused for 1 hour`);
  }
}

Check geography first, then layered rate limits, then a conversion breaker. Thresholds here are illustrative; set them from your own baseline.

Why does SMS pumping matter?

An attack can run up a large SMS bill in hours, and because pumped traffic is mixed with genuine OTPs, a blunt response (switching SMS off) locks real users out of sign-up and login. The defences are cheap if built in early: geo-permissions, layered rate limiting, a conversion-rate alarm and, where possible, verification channels that carry no termination fees, such as a WhatsApp authentication template or silent network authentication.

Best practices for SMS pumping

  • Put invisible bot checks on every form that can trigger an SMS, not just on login.
  • Ask your gateway for per-country spend caps and fraud alerts, and set them below what an attack could cost you in a night.
  • Log country, prefix, IP and device for each OTP request so you can reconstruct an attack.
  • Drop invalid, unallocated and inactive numbers before sending; an HLR lookup or line-type check costs less than a pumped SMS.
  • Offer WhatsApp or silent network authentication first where your users have them; there is no SMS termination fee to exploit.

AIT FAQs

How do I know if my app is being hit by SMS pumping?+
Look for a jump in OTP volume to an unusual country or number prefix with almost no codes verified. Other signs are sequential numbers, bursts outside your users' waking hours, many requests from data-centre IPs and an SMS bill far above your sign-up numbers.
Does DLT stop SMS pumping in India?+
Not by itself. DLT checks that a commercial SMS has a registered sender, template and chain; it does not judge whether a real person requested the OTP. Most attacks target international numbers through your forms, so the fix is on your side: allowlists, rate limits and conversion monitoring.
Is SMS pumping the same as a grey route?+
No. A grey route carries traffic over unofficial paths to avoid carrier fees, cheating operators. SMS pumping generates fake traffic so that someone collects those fees, cheating the business that sends it.
Can WhatsApp OTPs be pumped the same way?+
The SMS termination-fee incentive does not exist on WhatsApp, so the classic scheme does not pay. You are still billed for each delivered authentication template, though, so keep the same rate limits on any form that sends one.

See InfiQ pricing

Try it on the official WhatsApp Business API

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms