SMS pumping is exposing marketplace OTP costs and trust gaps

At a glance

What this is: This is an analysis of SMS pumping fraud and how it turns OTP verification into a cost-extraction mechanism for digital marketplaces while degrading phone-based trust signals.

Why it matters: It matters because IAM, fraud, and identity teams that still rely on SMS OTP for onboarding or step-up checks may be funding fraud while also corrupting downstream trust decisions.

Context

SMS pumping is a fraud pattern that exploits the economics of SMS delivery rather than the secrecy of credentials. In marketplace environments, the attacker does not need to take over an account first; the attack starts when a platform sends a verification code and pays for the message.

The identity governance problem is broader than one messaging channel. Once phone verification is treated as a reusable trust signal across onboarding, referrals, and risk scoring, inflated OTP traffic becomes both a financial drain and a governance failure because the signal and its cost can be attacked independently.

Prove Identity frames digital marketplaces as especially exposed because they optimise for low-friction growth and high-volume verification. That starting position is typical for consumer platforms, which is why the abuse pattern scales so effectively.

Key questions

Q: What breaks when SMS OTP is the only verification control for marketplaces?

A: SMS OTP becomes brittle when attackers can trigger sends without creating real user value. Marketplaces then pay for phantom traffic, while the same phone event can also unlock referral credits, onboarding, or trust scoring. The failure is not only weaker authentication. It is a governance breakdown where one reusable signal can be monetised by fraud.

Q: Why does SMS pumping increase both fraud risk and operating cost?

A: Because the platform pays for each message whether or not a legitimate user receives it. Fraudsters exploit that billing model by generating high-volume verification requests against premium routes, so the attack extracts money directly while also polluting identity and referral workflows. Cost and trust degrade together.

Q: How can security teams tell when SMS verification is being gamed?

A: Look for short bursts of SMS requests, repeated retries, sequential phone numbers, partially completed forms, and requests originating from geographies where the business has little or no user base. Those signals usually indicate scripted abuse rather than genuine consumer demand, especially when registration volume rises without a matching conversion rate.

Q: Should marketplaces replace SMS OTP in high-risk flows?

A: Yes, when the flow creates value beyond simple contact confirmation. If the verification step unlocks money movement, incentives, or privileged access, teams should use stronger controls than SMS alone and reserve OTP for lower-risk cases. The decision should be based on the downstream consequence of a false verification, not convenience.

Technical breakdown

How SMS pumping exploits the OTP delivery chain

SMS pumping abuses the multi-hop routing model behind OTP delivery. A platform sends a verification message to an SMS aggregator, which routes through carriers and terminating networks before delivery, and the platform pays per send even when no legitimate user receives or uses the code. Fraudsters profit by steering high-volume traffic into premium routes or grey-route number ranges that share revenue from inflated message volume. The control failure is not authentication alone, but the absence of upstream trust checks before the SMS request is issued.

Practical implication: treat the OTP send itself as a billable security event and gate it with pre-send risk decisions.

Why marketplace onboarding and referral flows are easy to abuse

Marketplaces often optimise registration and incentives for speed, which makes phone verification the main control in the loop. Attackers can script account creation, trigger OTP sends, and then claim referral rewards or create ghost accounts without ever interacting with a real user. The underlying problem is that the platform often treats a verified phone number as proof of personhood, when in practice it may only prove that a routable number accepted a message request.

Practical implication: separate phone ownership checks from reward eligibility and onboarding trust decisions.

Why SMS OTP no longer behaves like a durable identity factor

SMS OTP was designed to confirm phone possession, but several conditions weaken that assumption at once: SIM swap exposure, automated receive-and-submit loops, and routing opacity that hides which destinations are being abused. The result is a trust signal that can still work operationally while failing economically and analytically. For identity teams, that means the control may appear to function while its assurance value is already degraded.

Practical implication: measure SMS OTP as a risk signal, not as a standalone assurance mechanism.

Threat narrative

Attacker objective: The attacker seeks to convert verification traffic into revenue and incentives while degrading the platform's confidence in phone-based identity signals.

1. Entry begins when attackers submit fabricated or harvested phone numbers into registration, login, or number-change flows that trigger OTP sends.
2. Escalation occurs as automation and range selection concentrate requests on premium routes, creating high-volume phantom traffic that looks like normal verification demand.
3. Impact is realised through inflated telecom charges, referral abuse, and corrupted trust scoring across the marketplace identity lifecycle.

Breaches seen in the wild

• JetBrains Marketplace AI Plugin Campaign: 15 malicious JetBrains Marketplace plugins steal AI API keys from 70,000+ developers via supply chain attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS pumping is a trust-signal abuse problem, not just a billing problem. The article shows that the attacker profits by separating the cost of sending an OTP from any real identity assurance value. That breaks the common marketplace assumption that a verified phone number is a reliable proxy for user legitimacy. For identity teams, the implication is that trust decisions built on SMS delivery now need to be treated as attack surfaces, not just authentication steps.

Marketplace verification loops create identity blast radius. When the same phone-number event feeds onboarding, referral credits, worker activation, and fraud scoring, one fraudulent send can contaminate several downstream decisions at once. That is a governance problem because the identity signal is being reused far beyond the moment it was collected. Practitioners should view each verification trigger as part of a broader entitlement and trust chain, not as a standalone check.

Pre-send governance matters more than post-send detection in SMS pumping. The article makes clear that teams often discover the fraud only after traffic and invoice spikes arrive. By then, the cost and the trust damage have already propagated through the marketplace workflow. The field should therefore treat SMS request gating as part of identity governance, because post-facto analysis cannot recover money already spent or trust already polluted.

Phone intelligence is becoming a first-class governance input. Prove Identity's analysis points to carrier and number-range data as the kind of context that separates legitimate verification from fraud-driven traffic. That does not make the vendor the subject of the post; it shows the direction the market is moving. Identity programmes that still treat phone ownership as a static fact will remain exposed, while programmes that incorporate network context can reduce both fraud and verification waste.

Ephemeral verification economics are rewriting marketplace assurance. The cost of a verification event now changes the security model because attackers can weaponise volume without needing account takeover or stolen secrets. That means the old equation, where more checks implied more assurance, no longer holds. Practitioners need to rethink SMS OTP as a potentially hostile transaction boundary rather than a neutral step in the user journey.

What this signals

Identity teams should treat SMS verification as a metered control boundary. The important shift is not just moving away from SMS in every case, but recognising that each send is now an economic event that can be exploited. Once that happens, the verification workflow has to be governed like a high-risk transaction path rather than a neutral utility step.

Marketplace governance should separate proof of phone ownership from proof of user trust. SMS pumping succeeds because platforms collapse those two ideas into one flow. When onboarding, incentives, and access decisions all depend on the same phone event, fraud can contaminate the entire trust model from a single trigger.

For practitioners

• Instrument pre-send risk scoring Score OTP requests before dispatch using IP reputation, device consistency, number-range risk, and request velocity so suspicious traffic is blocked before the message leaves the platform.
• Decouple verification from incentives Require stronger checks before referral credits, onboarding bonuses, or worker activation are released, so a verified phone number alone cannot mint value.
• Add carrier and range intelligence Use number-range reputation, destination corridor data, and carrier metadata to identify premium-route abuse and hidden pumping patterns.
• Reduce reliance on SMS OTP alone Move high-risk flows toward step-up controls that do not depend on message delivery, especially where trust decisions cascade into payments, referrals, or access decisions.
• Monitor verification cost anomalies Track OTP spend per successful onboarding, per region, and per number range so unusual cost inflation becomes a fraud signal rather than a finance surprise.

Key takeaways

• SMS pumping turns OTP verification into a cost-extraction mechanism that also weakens phone-based trust signals in marketplace environments.
• The attack succeeds because platforms often reuse one phone verification event across onboarding, referrals, and fraud scoring.
• Teams need pre-send risk controls and reduced reliance on SMS OTP wherever a false verification can unlock money, access, or incentives.

Key terms

• SMS pumping: Fraud that exploits SMS delivery or verification flows to generate artificial message volume and cost. In identity programmes, the issue is not only billing abuse but also the overreliance on SMS as a trust channel for login, recovery, or step-up verification.
• Artificially Inflated Traffic: A fraud pattern where attackers generate large volumes of seemingly legitimate requests to create revenue, cost, or abuse opportunities. In identity flows, the target is often the trigger that sends OTPs or other paid messages, not the authenticated account itself.
• OTP Verification: OTP verification is the use of a one-time passcode to confirm that a phone number can receive a message. It is a low-friction control, but by itself it does not prove durable user identity, and in high-risk flows it can be abused as both a weak signal and a billable event.
• Phone Intelligence: Phone intelligence is the use of carrier, routing, and number-quality data to assess whether a phone number is likely to represent a legitimate user. In practice, it helps teams decide whether to send, challenge, or block an OTP before the message becomes a fraud event.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.