The Growth of SMS Fraud
SMS pumping fraud is a costly online abuse pattern, with global losses reaching an estimated $6.7 billion in 2021 alone. It targets companies that rely on SMS for verification or customer communications, leaving them to pay for traffic they did not request.
The scheme relies on malicious actors and dishonest telecom operators working together to generate and monetise large volumes of fraudulent text messages. For businesses caught in these schemes, the financial impact can be severe. Twitter (now X) reportedly lost $60 million to this type of fraud.
This guide explains how SMS pumping works, which businesses face the highest risk, and the controls your organisation can use to reduce exposure.
Understanding SMS Pumping Fraud
SMS pumping (also called SMS toll fraud, SMS spamming, or Artificially Inflated Traffic) involves manipulating mobile networks to inflate charges for text messages. The term "pumping" describes fraudsters forcing high SMS volume through a target's systems.
This fraud exploits how SMS messages travel and get billed across phone networks. Attackers target companies that use SMS codes to verify users. Each time a business sends a verification code, it pays a fee. Fraudsters trigger these systems to send thousands of messages to numbers they control.
These attacks create direct costs for businesses and revenue for the attackers. The fraud works through coordination between criminals and corrupt telecom operators, who charge premium rates for message delivery and share the proceeds.
The fraud has changed as more businesses have adopted SMS verification. Attackers keep developing new methods, and the phone industry has not removed the risk. Many companies still carry the financial exposure.
How SMS Pumping Works
SMS pumping attacks usually exploit message systems through these steps:
- Finding Targets: Attackers look for websites or apps that send SMS codes for account verification or password resets.
- Creating Fake Requests: Fraudsters use automation to send thousands of code requests to phone numbers they own or control.
- Hiding Their Tracks: Attackers change their IP addresses and device information so requests appear to come from real users.
- Sharing Profits: Fraudsters work with dishonest phone companies that charge high fees when messages pass through their networks. These companies then share the money with the attackers.
- Using Complex Routes: Messages travel through many networks before reaching their destination, making the source of the fraud harder to trace.
- Targeting Expensive Routes: Attackers focus on international numbers where sending messages costs more or where rules are weaker.
These attacks look legitimate because each message contains a real code sent to what appears to be a normal phone number. Companies like Twilio or Bird must pay fees to deliver these messages. Most businesses only find out about the fraud when a large bill arrives from their SMS service.
SMS pumping differs from basic spam because the profit-sharing between attackers and phone companies creates a direct cost for the target business.
Businesses at Risk
SMS pumping is most likely to affect these types of businesses:
Financial Institutions
Banks, investment platforms, and cryptocurrency exchanges use SMS codes to protect accounts. These firms send thousands of codes each day, which makes it hard to spot fake requests mixed with real ones.
E-commerce Platforms
Online shops use SMS messages when users create accounts, reset passwords, or make purchases. These businesses often run on small profit margins, so extra SMS costs can hurt their earnings. High volumes of new users make it easier for attackers to hide their activity.
Social Media Companies
Social networks use text messages to check user identity and stop fake accounts. These companies send millions of codes each day to users around the world. Twitter lost $60 million from this type of fraud, showing the scale these bills can reach.
Software-as-a-Service (SaaS) Providers
These companies often offer free trials that require SMS verification. They plan for a set cost to acquire each new user, but fraud can push these costs much higher than expected.
Telecommunications Companies
Phone companies face two problems: their own systems can be attacked, and parts of their network might help fraudsters. They need strong monitoring tools to find unusual patterns in message traffic.
Small Businesses and Startups
While smaller firms send fewer messages, they often lack security teams and fraud detection tools. This makes them easier targets. The cost of an attack can put these businesses at risk of closing down because they have less money in reserve.
Advanced Attack Methods
Attackers now combine SMS pumping with other techniques to avoid detection.
Credential Stuffing
Fraudsters use passwords stolen in data breaches to break into accounts. Once inside, they change phone numbers to ones they control and trigger verification messages. This makes fraud appear to come from real users.
Peakhour's breach database detection identifies when stolen credentials are used to access accounts. The system flags these attempts before phone numbers can be changed, stopping the attack chain.
Residential Proxy Networks
Unlike data centre proxies that security systems can often spot, residential proxies hide attack traffic behind home internet connections. This makes fraud look like it comes from regular users in different locations.
Peakhour specialises in residential proxy detection. Its technology identifies these masked connections and blocks them before verification requests can pass through. The system maps known proxy networks and detects signs of traffic passing through residential IPs.
When combined with device fingerprinting, these protections create a stronger defence. Fingerprinting tracks device characteristics that remain consistent even when attackers change IP addresses or accounts. Peakhour's fingerprinting technology works without cookies, making it effective against attackers who clear browser data.
These methods focus on the techniques fraudsters use to hide their identity. With Peakhour's protection, businesses can detect and block these attacks before they trigger costly SMS verification messages.
Historical Incidents
Reported SMS pumping incidents show how quickly costs can build:
Twitter's $60 Million Loss
In January 2023, Twitter owner Elon Musk said the platform lost more than $60 million to SMS pumping fraud. He named over 390 phone companies that took part in the scheme. While Twitter later questioned some claims, the case brought public attention to this type of fraud.
Industry-Wide Financial Impact
The Communications Fraud Control Association reports that SMS pumping caused global losses of $6.7 billion in 2021. Many companies do not share their fraud losses with the public.
Costs to Individual Businesses
Companies hit by these attacks pay between tens of thousands and millions of dollars each month in fake charges. These costs grow fast because each fake message costs much more than normal text rates.
Verification Policy Changes
Because of these threats, many large platforms have moved away from SMS codes. Twitter removed SMS verification for most users in March 2023, stating fraud as the reason.
Operational Disruptions
Beyond the cost of messages, businesses can face service problems during attacks. Real users may not get their codes on time. This can cause users to abandon transactions, contact support more often, and lose confidence in the company.
Rules and Enforcement
Rules to stop these attacks differ around the world. Some telecoms authorities have strict rules and fines for networks that allow fraud, but enforcement remains hard. Fraudsters use complex message routes that cross many countries to avoid getting caught.
Understanding the Stakeholders
SMS pumping involves these key groups:
Businesses
Companies use SMS to check user identity and send updates. They hire SMS gateway providers to handle their messages. When fraud happens, these businesses pay for the fake messages. Most find out about the attack only when they receive an unexpected bill.
SMS Gateway Providers
Companies like Twilio and MessageBird connect businesses to phone carriers. They give businesses tools to send text messages without working with phone networks directly. When fraud passes through their systems, these providers may try to stop it, but still charge businesses for the messages sent.
Mobile Network Operators (MNOs)
These companies run the networks that deliver messages to phones. Most work honestly, but SMS pumping schemes often include corrupt operators who charge extra fees for messages to numbers they control. These operators then split the money with the attackers who started the fraud.
Content Aggregators
These middlemen combine message traffic and work with many carriers to find the best routes. Most run honest operations, but their position in the message chain creates routing and oversight gaps that attackers can use.
Regulatory Bodies
Groups like the GSM Association create rules and standards for the industry. These rules are hard to enforce because phone networks cross many countries with different laws.
Financial Flow
The payment flow starts when businesses pay gateway providers to send messages. The gateway providers then pay fees to network operators based on where messages go. In fraud schemes, inflated fees go to corrupt operators who share the money with attackers. This creates a system where sending more fake messages makes more money for criminals while costing honest businesses more.
Effective Protection Strategies
Protecting your organisation usually requires several controls:
Basic Protections
- Rate Limits: Restrict how many verification attempts a user can make in a set time period.
- Traffic Pattern Checks: Track normal SMS message patterns and watch for changes that might indicate attacks.
- Provider Protection: Services like Prelude's SMS Pumping Protection find and block messages to fake numbers.
- Other Ways to Verify Users: Use app-based verification or push alerts instead of SMS codes.
- Control by Country: Limit SMS verification to countries where you do business and add more checks for countries with higher fraud risk.
- Work with Trusted Partners: Choose SMS service providers that focus on security and can help stop fraud quickly.
Advanced Protection Methods
- Residential Proxy Detection: Find and block users who hide their true location behind home networks used as proxies.
- Device Fingerprinting: Collect device signals to track users across sessions and spot when many verification requests come from the same device.
- User Behaviour Tracking: Learn how real users act on your site and flag unusual actions that might be bots.
- Machine Learning Systems: Use systems that learn from data to find hidden fraud patterns and adapt to new attack types.
- Phone Number Checks: Use lists of known bad numbers to decide which phone numbers need more verification steps.
- Verify in Multiple Ways: Ask users to prove who they are in different ways, such as email plus SMS, to make attacks harder.
- Work with Other Companies: Share information about new attack methods and bad phone numbers with other businesses.
- Watch Transactions as They Happen: Use systems that can pause message sending when they spot unusual patterns and learn from both legitimate and abusive traffic.
Fighting SMS Pumping Fraud
SMS pumping fraud costs businesses $6.7 billion worldwide each year. Companies like Twitter lost $60 million to these attacks, showing that scale alone does not remove the risk.
SMS pumping works through a network of fraudsters, network operators, and service providers who exploit the payment system for text messages. Fraudsters target authentication systems to generate large volumes of SMS, then collect revenue shares from the process.
Peakhour and Prelude offer combined protection against these threats. Peakhour provides device fingerprinting to identify suspicious devices attempting verification. Its residential proxy detection stops fraudsters who hide behind legitimate IP addresses. These tools block attackers before they access verification systems.
Prelude complements this protection with their multi-routing SMS verification platform. Its system uses real-time fraud detection across five messaging channels in 230 countries. When Prelude detects a potential attack, it automatically redirects traffic through secure routes.
Businesses need to understand the SMS delivery chain to protect themselves. Gateway providers, network operators, and content aggregators each introduce possible points of exploitation.
Prevention requires multiple security layers:
- Rate limiting to restrict message volume
- Device fingerprinting to track suspicious patterns
- Residential proxy detection to unmask hidden attackers
- Behavioural analytics to spot unusual activity
- Machine learning to adapt to new attack methods
- Continuous learning based on real user interactions
The continuous learning systems from both Peakhour and Prelude build protection that improves with each user interaction. Their platforms analyse legitimate traffic patterns to differentiate them from attacks, helping protection adapt over time.
While SMS verification remains common, Peakhour and Prelude help businesses implement more secure authentication methods. Together, they provide protection that adapts to evolving threats and reduces the cost of fraudulent verification traffic.
See how Peakhour's Application Security Platform helps protect against SMS pumping and other automated threats. Contact our team to secure your applications.
