SMS pumping exposes the trust gap in phone verification flows

At a glance

What this is: This is an analysis of SMS pumping, where attackers abuse OTP send flows to generate fraudulent message traffic rather than steal accounts.

Why it matters: It matters because IAM teams cannot treat phone verification as a neutral control when the send itself becomes the monetisable event and the verification step is never completed.

Context

SMS pumping is a fraud pattern that abuses phone verification flows by triggering real OTP messages without any intention of completing the login or signup. The control gap is that many identity programmes still treat the act of sending a code as proof of legitimate intent, when the attacker only needs the application to place the message.

For IAM teams, the problem sits in verification orchestration rather than authentication strength. Once the SMS send becomes the target, volume, route selection, channel choice, and fallback logic become governance decisions, not just product settings.

The article frames the issue as a trust problem in phone-first journeys. That makes it relevant to consumer IAM, fraud controls, and step-up design, especially where SMS remains the default fallback channel.

Key questions

Q: What breaks when SMS verification is treated as a low-risk control point?

A: What breaks is the assumption that verification traffic is merely an operational cost. Human fraud farms turn the send itself into the attack objective, so session-level controls can miss the abuse until the bill has already accumulated. The failure is not authentication logic alone, but delayed enforcement at the flow that creates spend.

Q: Why does SMS pumping increase both fraud risk and operating cost?

A: Because the platform pays for each message whether or not a legitimate user receives it. Fraudsters exploit that billing model by generating high-volume verification requests against premium routes, so the attack extracts money directly while also polluting identity and referral workflows. Cost and trust degrade together.

Q: How can IAM teams tell whether OTP traffic is being abused?

A: Look for OTP sends rising while successful verifications stay flat, especially when requests cluster around shared prefixes, high-risk countries, or repeated retries from similar devices. The key signal is not volume alone, but the growing gap between messages sent and verifications completed.

Q: Should organisations replace SMS with passkeys or silent authentication first?

A: Where supported, yes. Passkeys remove the message-send path for returning users, and silent network authentication verifies some users without an SMS at all. The right sequencing is to remove routine SMS exposure first, then reserve it for fallback and recovery.

Technical breakdown

How SMS pumping monetises the OTP send path

SMS pumping works by turning an identity verification message into telecom revenue. Bots trigger OTP sends to real numbers, often across profitable routes where a portion of termination fees flows back to the fraudster or a partner network. The code is irrelevant because the attacker is not seeking account access. The send is the payout, which means the attack exploits the business logic of the verification flow rather than the secrecy of the OTP itself. That is why basic validation of the phone number rarely stops it.

Practical implication: control the decision to send SMS, not just the content of the code.

Why simple phone validation misses the abuse

Phone lookup and carrier validation can confirm that a number exists, but they do not tell you whether the request is economically abusive. Attackers can use live numbers on legitimate networks, distribute requests across prefixes, and rotate IPs so the traffic looks like normal growth. The more the flow relies on a single signal, the easier it is to misread attack traffic as onboarding demand. In practice, the attack succeeds because the system has no strong pre-send decision point.

Practical implication: add prefix, country, device, and velocity signals before the send request is approved.

How channel orchestration reduces the attack surface

The strongest mitigation is not stronger SMS content, but better channel selection. Silent network authentication can verify supported users without sending a message at all, while passkeys remove the OTP send path for returning users. Where SMS remains necessary, runtime routing can shift high-risk countries or suspicious prefixes to WhatsApp or email instead. This is identity orchestration, not just fraud filtering, because the channel choice itself determines whether the exposure exists.

Practical implication: move channel selection into policy logic so SMS is only one option among several.

Threat narrative

Attacker objective: The attacker aims to generate fraudulent SMS traffic that produces telecom revenue while avoiding the work of account takeover.

1. Entry occurs when bots submit phone numbers into signup, login, or password-reset flows that will send an OTP on demand.
2. Credential abuse is not the point here because the attacker does not need the code; the abuse is the authorised SMS send itself.
3. Impact follows when the organisation pays termination or routing fees for messages that never convert into verified users.

Breaches seen in the wild

• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS pumping is a verification-governance problem, not an OTP-security problem. The attack succeeds because teams often model phone verification as a benign step that only helps prove identity. In reality, the send request itself creates financial exposure and should be governed as a controlled business action, not an automatic side effect. Practitioners should treat channel decisioning as part of identity governance, not a cosmetic UX choice.

Static SMS defaulting creates a standing exposure window. Any workflow that sends SMS before evaluating country, prefix, device reputation, or user history gives attackers a predictable monetisation path. The control failure is not the absence of a stronger code. It is the assumption that every request deserves the same channel, even when risk signals already point elsewhere. Teams should reframe SMS as a conditional fallback, not a default entitlement.

Channel choice is now a core control surface for consumer IAM. Passkeys, silent network authentication, WhatsApp, and email are no longer just convenience alternatives. They are ways to prevent the verification send from becoming the attack target in the first place. The field should stop measuring only completion rates and start measuring how often high-risk flows avoid SMS altogether.

Every SMS should need justification before it is sent. That is the named concept this article surfaces: the message-send decision has become a governed security event. Once teams accept that premise, rate limits, geo-permissions, provider alerts, and channel routing become part of the identity control model rather than optional fraud add-ons.

Provider-side controls are necessary but not sufficient. Spend caps, alerts, and pumping detection help contain damage, but they do not solve the trust assumption that any phone submission should trigger a message. The practical conclusion is to reduce send frequency upstream, then use provider controls as a backstop rather than the primary defence.

What this signals

Every SMS should need justification: verification flows now behave like spend-bearing transactions, so policy must decide whether a message is warranted before any OTP leaves the system. That changes SMS from a convenience channel into a governed risk decision for consumer IAM and fraud operations.

Passkeys and silent network authentication are doing more than improving UX. They reduce the number of situations where an attacker can monetize a verification request, which makes channel orchestration a cost-control issue as much as a security one.

For practitioners

• Implement pre-send channel policy Require a risk decision before any SMS OTP is sent. Use country, prefix, device reputation, IP velocity, and prior enrolment to decide whether SMS, WhatsApp, email, or passkeys should be used.
• Set prefix-level and country-level throttles Limit repeated OTP sends by phone number, prefix, and destination country so concentrated abuse patterns are visible and can be blocked before invoices spike.
• Move returning users to passkeys Prompt passkey enrolment after successful login and make it the default for returning users, so routine verification no longer depends on a reusable SMS send path.
• Use silent verification where coverage exists Attempt silent network authentication first for supported carriers and fall back to SMS only when the number or network cannot be verified that way.
• Tighten provider-level fraud backstops Enable spend limits, volume alerts, geo-permissions, and pumping detection with the SMS provider so residual abuse is capped when upstream policy misses it.

Key takeaways

• SMS pumping exploits the verification send path itself, so the main governance issue is whether a message should be sent at all.
• The abuse can generate material cost without account takeover, which is why flat verification success rates matter more than raw send volume.
• The most effective response is to shift routine users away from SMS and make channel choice conditional on risk signals.

Key terms

• SMS pumping: Fraud that exploits SMS delivery or verification flows to generate artificial message volume and cost. In identity programmes, the issue is not only billing abuse but also the overreliance on SMS as a trust channel for login, recovery, or step-up verification.
• Artificially Inflated Traffic: A fraud pattern where attackers generate large volumes of seemingly legitimate requests to create revenue, cost, or abuse opportunities. In identity flows, the target is often the trigger that sends OTPs or other paid messages, not the authenticated account itself.
• Silent Network Authentication: A phone-number verification method that confirms device and SIM association through the carrier network instead of sending a one-time code. It reduces exposure to phishing and SMS pumping because the user does not need to read or return a secret.
• Channel Orchestration: Channel orchestration is the policy-driven selection of the verification method used for a specific request. For identity teams, it means deciding whether SMS, email, WhatsApp, passkeys, or another method should be used based on risk, geography, and enrolment state.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.