Artificially inflated traffic fraud exposes SMS OTP abuse

At a glance

What this is: Arkose Labs describes artificially inflated traffic fraud as a scheme that abuses online forms and SMS OTP flows to generate illegitimate message volume and revenue.

Why it matters: It matters because IAM, fraud, and customer-identity teams have to treat OTP delivery as an abuse surface, not just a verification step.

Context

Artificially inflated traffic fraud is a form of abuse in which attackers manipulate online forms and phone number fields to trigger one-time passcodes by SMS. The identity problem is not the OTP itself, but the fact that the verification channel can be turned into a revenue-generating abuse path.

This is a governance problem for customer identity flows, fraud controls, and telecom billing relationships at the same time. When message volume can be manufactured, organisations need to distinguish legitimate verification demand from traffic pumping before the abuse becomes a financial issue.

Key questions

Q: What breaks when SMS OTP flows are used for traffic pumping?

A: The verification channel stops behaving like a trust step and starts behaving like a revenue target. Attackers can generate repeated sends without compromising accounts, so the control failure is at the request boundary. Teams lose money through message fees, then spend more time disputing charges and tracing abuse than they would have spent preventing it.

Q: Why do SMS verification systems attract fraud even when login security is intact?

A: Because the attacker can profit from triggering the message rather than stealing the account. If the system charges per send or shares revenue through the delivery chain, legitimate authentication traffic becomes a monetisation surface. The risk comes from cost-bearing delivery mechanics, not just from identity assurance weakness.

Q: How can security teams tell OTP abuse from normal verification demand?

A: Look for repeated sends to the same number, abnormal request volume from one source, and traffic that does not match user behaviour or conversion patterns. A surge in OTP requests with low downstream completion is a strong sign that the flow is being farmed for message volume, not used for genuine verification.

Q: Who should own controls for SMS OTP abuse and billing fraud?

A: Ownership has to be shared across IAM, fraud operations, application security, and telecom or billing stakeholders. The abuse spans request legitimacy, delivery cost, and dispute handling, so no single team can see the whole problem. Clear accountability matters because the harm often appears first as a billing issue, not a security incident.

Technical breakdown

How SMS OTP abuse becomes traffic pumping

The mechanism starts with an online form or interface that accepts a phone number and then sends an OTP by SMS. Attackers automate or manipulate the submission flow to create large numbers of verification requests, which increases SMS traffic without corresponding legitimate user demand. Because each message can generate a fee, the abuse is not limited to identity verification failure. It becomes an economic loop where the attacker benefits from triggering message delivery itself, especially when intermediaries in the messaging chain also share in the transaction flow.

Practical implication: Instrument OTP request patterns as abuse telemetry, not only authentication telemetry.

Why toll fraud and SMS verification are linked

Toll fraud appears when attackers exploit the billing mechanics around SMS delivery, toll-free numbers, or revenue-sharing agreements. The article’s key point is that the attack can extract value from the communication chain even when the identity system is not the direct target. That means a customer verification workflow can inadvertently create a monetisation surface for adversaries. The operational weakness is usually not cryptographic failure or account takeover; it is the absence of controls that separate legitimate verification demand from manufactured traffic.

Practical implication: Review OTP flows for cost-exposure controls and abuse thresholds.

Why attribution is difficult in message-chain fraud

AIT fraud is hard to trace because the path between the sender, intermediaries, and recipient obscures where the abusive demand originated. The fraudster may never need to compromise an account in the traditional sense. Instead, they exploit the system’s willingness to send messages on request. This shifts the control problem toward origin validation, request pattern analysis, and denial of economically abusive behaviour. For practitioners, the important distinction is between identity assurance and request legitimacy, because a valid phone number does not mean a valid verification request.

Practical implication: Correlate request origin, device signals, and volume anomalies before permitting high-cost verification sends.

Threat narrative

Attacker objective: The attacker aims to monetise artificially generated SMS traffic and shift message costs onto businesses and telecom intermediaries.

1. Entry begins when attackers manipulate online forms or interfaces that accept phone numbers and initiate SMS OTP delivery.
2. Credential harvesting is replaced by abuse of verification demand, as the attacker repeatedly triggers OTP requests to generate illegitimate traffic.
3. Escalation occurs when the request volume is amplified across the messaging chain, turning small per-message fees into material fraudulent revenue.
4. Impact is financial loss for businesses and service providers, along with trust damage and operational disruption from disputed billing and abuse remediation.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS OTP abuse is a billing and abuse-control problem before it is an identity problem. The article shows that attackers do not need to defeat authentication if they can weaponise the verification channel itself. That shifts the governance question from whether a code is strong enough to whether the request that created it was legitimate. Practitioners should treat verification traffic as a protected service, not a neutral by-product of sign-in.

Traffic pumping exposes a weak assumption in many customer identity flows: that verification demand is user-generated and economically harmless. That assumption fails when a form, API, or interface can be scripted into repeated SMS sends. Once that happens, the OTP pipeline becomes a revenue surface, not just a trust surface. The implication is that identity and fraud teams need a shared control model for request legitimacy and messaging cost exposure.

Artificially inflated traffic creates a governance gap between authentication assurance and channel assurance. An organisation can still know who a user is while failing to control how often and why messages are being sent. That gap matters because billing abuse can persist without classic account compromise. Practitioners should separate identity proofing outcomes from delivery-channel abuse detection and governance.

SMS-based verification remains operationally useful, but it is structurally exposed to abuse when cost and legitimacy are not linked in policy. The article’s examples show how quickly fraud can turn modest per-message charges into material losses. That should push security leaders to ask which controls sit at the request boundary, not only at the login boundary. The practitioner takeaway is to govern the send event as tightly as the authentication event.

Traffic pumping is a form of identity-adjacent fraud that sits at the intersection of IAM, fraud operations, and telecom settlement risk. No single team owns the full attack surface, which is why these schemes survive in the seams between functions. The field should stop treating SMS OTP abuse as an edge case and start treating it as a recurring control design problem. Practitioners should align ownership before the billing dispute begins.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Traffic pumping creates a control gap at the request boundary. Organisations often secure the OTP itself while leaving the send event under-governed. That is the wrong boundary to trust, because the abuse starts before authentication completes and the cost is already in motion.

SMS verification needs abuse governance, not only identity assurance. The practical question is whether a request deserves to consume a paid communication channel at all. Teams should design decision points that can deny economically abusive sends even when the underlying user journey looks valid.

For practitioners

• Rate-limit OTP requests by origin and device pattern Set per-number, per-device, and per-IP thresholds that block repetitive verification sends before message volume becomes financially abusive.
• Separate verification success from send approval Require abuse checks at the moment of request so a valid user journey does not automatically authorize an SMS send.
• Add cost-exposure monitoring to OTP flows Track message spikes, billing anomalies, and high-cost destinations as operational signals, not just fraud accounting after the fact.
• Correlate form abuse with telecom disputes Join application telemetry, messaging logs, and carrier invoices so pumping patterns can be traced across the full delivery chain.

Key takeaways

• SMS OTP abuse can turn routine verification into a monetisation channel for attackers and a cost centre for businesses.
• The attack works by manufacturing message volume, which makes billing exposure and attribution problems part of the security issue.
• Practitioners need controls at the request boundary, where legitimacy and delivery cost are decided before the OTP is sent.

Key terms

• Artificially Inflated Traffic: A fraud pattern where attackers generate large volumes of seemingly legitimate requests to create revenue, cost, or abuse opportunities. In identity flows, the target is often the trigger that sends OTPs or other paid messages, not the authenticated account itself.
• SMS Traffic Pumping: An abuse technique that forces excessive SMS delivery volume so that fees are generated across the messaging chain. The attacker profits indirectly by creating demand, while the affected organisation absorbs cost, disputes, and operational noise.
• Toll Fraud: Unauthorized exploitation of communication services that produces financial loss through manipulated routing or billing relationships. In identity-adjacent abuse, toll fraud often rides on verification or recovery flows that were never designed to resist high-volume automation.
• Verification Channel Abuse: Verification channel abuse occurs when a process meant to confirm identity is manipulated to create unwanted cost, noise, or operational load. The channel still functions technically, but its governance fails because request legitimacy and delivery economics are not controlled together.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.