TL;DR: Gig economy platforms are being targeted by bot-driven SMS toll fraud, with attackers using fake signups and premium-rate numbers to trigger irreversible message charges and drain telecom budgets, according to Arkose Labs. The pattern shows that SMS abuse is now a fraud control problem, not just a messaging problem.
At a glance
What this is: This is an analysis of bot-driven SMS toll fraud in gig platforms, where automated fake signups exploit SMS authentication and messaging flows to generate avoidable telecom charges.
Why it matters: IAM, fraud, and platform security teams need to treat SMS abuse as a pre-authentication control problem, because the financial loss happens before normal account governance can intervene.
By the numbers:
- The global gig economy is projected to reach $873 billion in 2028, up from $355 billion in 2021.
- Last year, nearly 6% of all SMS messages were sent to artificially generated traffic.
- That figure swells to anywhere between 30% and 60% for top brands.
Context
Gig platforms often rely on SMS for registration, login verification, job alerts, reminders, and support. That makes the channel operationally useful, but also easy to abuse when bots can trigger messages at scale without ever becoming legitimate users.
The security gap is not in messaging alone, but in the identity and fraud controls that sit before SMS outflow. If a platform cannot distinguish genuine signups from automated abuse early, it absorbs irreversible message costs and reputational damage before any downstream access control can help.
Key questions
Q: What breaks when bots can trigger SMS verification before account creation is validated?
A: The control that breaks is the assumption that verification traffic is a sign of genuine intent. When bots can trigger SMS at scale, the platform pays for abuse before identity is established, so the right control point is request gating and fraud scoring ahead of message issuance.
Q: Why does SMS toll fraud create IAM risk as well as financial risk?
A: SMS toll fraud turns an identity control channel into a monetisation channel. If login, recovery, or verification relies too heavily on SMS, attackers can abuse that path to drive costs, weaken trust, or redirect users. That makes SMS dependency a governance issue, not just a telecom or billing issue.
Q: What are the signs that SMS abuse controls are failing?
A: Warning signs include repeated OTP requests, spikes in sign-ups from the same behavioural pattern, abnormal use of premium-rate numbers, and a growing share of messages that never reach real users. Those signals indicate that the platform is accepting traffic too late in the decision chain.
Q: How should security teams stop SMS toll fraud before cost accumulates?
A: Security teams should place enforcement at the point where the SMS send is triggered, not after the message is delivered. That means suspicious sessions must be challenged or blocked before the platform pays the carrier. The control objective is to prevent the transaction from completing, because post-event detection only explains the loss after it has already been incurred.
Technical breakdown
How bot-driven SMS toll fraud works
SMS toll fraud, also called SMS pumping or international revenue share fraud, uses automated account creation or OTP requests to trigger messages to premium-rate numbers. The attacker does not need durable access after the message is sent. The abuse path is front-loaded: bots submit forms, request verification, and stop once the SMS has been generated, while the platform bears the charge. This is why the attack scales with signup volume and mobile-first workflows. The fraud is economic rather than technical at its core, but it exploits a technical assumption that verification traffic is inherently legitimate.
Practical implication: place bot detection in front of SMS issuance, not after the message has already been generated.
Why SMS is a high-value abuse channel for gig platforms
Gig platforms use SMS across authentication, user coordination, and customer support, so the channel carries both trust and operational load. That broad use creates an asymmetric risk surface: a single bot can consume messaging budgets, mimic valid user journeys, and exploit workflows that were designed for convenience rather than abuse resistance. The article notes that much of this traffic is not reaching legitimate users, which means the platform is paying for a communication channel that adversaries can treat as a monetisation rail. The problem intensifies when SMS is part of onboarding or MFA because the platform is incentivised to trust the channel early.
Practical implication: segment SMS use cases and treat authentication, notification, and support flows as separate fraud surfaces.
Why legacy CAPTCHAs are not enough
CAPTCHAs were designed to slow simple automation, not to govern sophisticated bot fleets that can vary behaviour, rotate infrastructure, and mimic human interaction. The article’s point is not that challenge mechanisms are useless, but that outdated variants no longer keep pace with modern bot operations. Effective mitigation requires controls that analyse broader digital signals and can stop fraud before SMS initiation. In practice, that means moving from static friction to risk-based detection and challenge orchestration. If the control only reacts after a request is accepted, it arrives too late for irreversible messaging costs.
Practical implication: replace static challenge checks with layered bot mitigation that scores the request before SMS delivery.
Threat narrative
Attacker objective: The attacker’s objective is to monetise automated SMS requests by shifting message costs onto the platform and splitting the proceeds with colluding partners.
- Entry occurs when bots submit fake registrations or OTP requests through web forms and mobile app flows linked to SMS systems.
- Credential or verification abuse follows when premium-rate phone numbers are supplied for authentication and the platform generates messages to those destinations.
- Impact lands as irreversible SMS charges, telecom expense inflation, and fraud-driven erosion of user trust.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SMS toll fraud is an identity-fraud problem that happens before authentication succeeds. The platform is not being breached in the classic sense, but it is being induced to trust and pay for traffic that should never have been treated as legitimate. That shifts the control point to sign-up and verification gating, where abuse can still be stopped before cost is incurred. Practitioners should read this as a pre-authentication fraud-control failure, not a messaging tuning issue.
Irreversible messaging turns weak bot control into direct financial leakage. Once an SMS is sent, the cost cannot be recovered, which means the control objective is not merely detection but prevention at the point of initiation. This is a materially different governance model from post-event review, because the loss is already booked when the message leaves the platform. The implication is that fraud and IAM teams need shared ownership of the SMS trust boundary.
Gig platforms expose a broader identity blast radius because SMS supports both access and operations. A channel used for MFA, job alerts, support, and reminders creates multiple paths for abuse, and attackers will target the easiest one. Identity blast radius: the total operational and financial damage that follows when one trusted channel is abused across several workflows. Practitioners should separate controls by SMS use case instead of assuming one anti-bot layer protects every flow.
Legacy challenge tools fail when the attacker adapts faster than the policy does. Static CAPTCHA assumptions were built for simple automation, not for distributed bot activity that can sustain high-volume request patterns. That is why the current problem is not whether a challenge exists, but whether it can reliably distinguish fraudulent initiation from genuine user demand. Practitioners should treat challenge design as a fraud decision layer, not a checkbox control.
Fraud governance for SMS must be tied to platform economics, not just account security. The article shows that the business impact is telecom spend, operational friction, and reputational harm, which are all measurable outside the identity stack. That makes SMS toll fraud a board-relevant control problem in fast-growing digital platforms. Practitioners should align fraud controls with cost containment and customer trust outcomes.
From our research library:
- U.S. fraud losses are projected to reach $40 billion by 2027.
What this signals
Identity trust at the messaging edge now matters as much as access governance. When SMS is used for onboarding and verification, the first control decision is whether a request deserves to create cost at all. Platforms that treat that step as a pure messaging function will keep paying for traffic that should have been blocked in the fraud layer.
SMS abuse has become a governance problem, not just an abuse-detection problem. The operating question is no longer whether bots exist, but which business flows are allowed to trigger billable messages before trust is established. That makes SMS policy, fraud engineering, and identity assurance part of the same control plane.
Bot-driven toll fraud is a reminder that irreversible actions need stronger front-door controls. Once a message is sent, the platform cannot unwind the spend. Teams should therefore review where their current journeys still assume that a verification request is harmless until proven otherwise.
For practitioners
- Implement pre-SMS bot gating Place detection and mitigation controls before OTP generation or outbound notification triggers, so automated requests are scored before any billable message leaves the platform.
- Separate SMS use cases Treat authentication, job alerts, support, and reminder messaging as distinct abuse surfaces, each with its own thresholds, monitoring, and exception handling.
- Replace static CAPTCHAs Use risk-based challenges and behavioural signals that can adapt to bot variation instead of relying on outdated friction that attackers can work around.
- Monitor premium-rate traffic patterns Track spikes in OTP requests, repeated registration attempts, and unusual destination numbering so finance and security teams can intervene before losses accumulate.
Key takeaways
- Bot-driven SMS toll fraud exploits the point where platforms trust verification requests before they know whether the requester is genuine.
- The article shows that the impact is immediate and financial because SMS charges cannot be reversed once the message is sent.
- The limiting control is pre-send bot mitigation, not post-send investigation, because the loss is created at initiation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on abuse of SMS-based verification and OTP flows. |
| NHI-10 — Human Use of NHI | Bots exploit human-trust assumptions in user-facing SMS workflows. | |
| Recommendation — Harden SMS-driven authentication journeys against automated signups and verification abuse. Separate user trust decisions from machine-triggered SMS workflows and block suspicious initiation early. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is trust and authorisation at the point of message initiation. |
| ID.RA-01 — Asset vulnerabilities are identified and documented | Abuse risk emerges from exposed SMS workflows and weak initiation controls. | |
| Recommendation — Apply PR.AA-05 logic to ensure only validated requests can trigger billable SMS actions. Document SMS abuse paths and risk-score the flows that can create direct cost. | ||
| CIS Controls v8 | CIS-5 — Account Management | Fake account creation is the enabling path for SMS toll fraud. |
| Recommendation — Tighten account management checks to reduce automated fake registrations that drive toll fraud. | ||
| MITRE ATT&CK | TA0001;TA0040 — Initial Access; Impact | The attack uses automated signup entry to cause financial impact through billable messages. |
| Recommendation — Map automated signup abuse to Initial Access and Impact to prioritise detection before SMS delivery. | ||
Key terms
- SMS Toll Fraud: SMS toll fraud is the abuse of authentication or verification flows to generate revenue from premium-rate or otherwise monetised message delivery. The attacker does not need to steal accounts or payments. The platform’s own identity traffic becomes the mechanism that produces loss.
- Bot mitigation: Bot mitigation is the use of behavioural, device, and session signals to distinguish automated traffic from legitimate users. In fraud-sensitive workflows, it is a pre-action control that must decide whether a request is allowed to reach a chargeable or privileged step.
- Premium-Rate Line: A premium-rate line is a phone service that generates payouts when messages are delivered or activity is routed through it. In toll-fraud campaigns, attackers use these numbers as the destination for high-volume SMS sends so the platform’s verification traffic is converted into revenue.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org