SMS toll fraud exposes the governance gap in MFA delivery

At a glance

What this is: SMS toll fraud is an abuse pattern where bots trigger high volumes of MFA or verification texts to premium-rate numbers, turning identity checks into a financial drain.

Why it matters: IAM and fraud teams need to treat SMS delivery as a governable business risk because the abuse sits in the authentication path, not just in the telecom layer.

Context

SMS toll fraud, also called SMS pumping, is an abuse of authentication delivery rather than a break-in of the authentication code itself. Attackers create accounts at scale, push one-time passcodes to premium-rate numbers, and leave the business paying for messages that never authenticate a real user.

For financial institutions, the problem extends beyond fraud losses. The article frames SMS-based verification as a governance issue because repeated abuse can disrupt operations, invite regulatory scrutiny, and expose a control path that many IAM programmes still treat as routine rather than financially material.

Key questions

Q: What breaks when attackers can trigger SMS verification at scale?

A: The control breaks at initiation time, not at code validation. If bots can cheaply create accounts or submit numbers faster than abuse controls respond, the organisation pays for delivery before any identity proofing occurs. That turns MFA messaging into a cost-bearing surface and leaves the business exposed to repeat billing, operational noise, and weak recovery options.

Q: Why do SMS based OTPs increase payment fraud risk in UPI and mobile banking flows?

A: SMS OTPs create risk because the message can be forwarded, intercepted, or stolen after a user is tricked into installing malware or entering details on a fake site. In UPI and banking flows, that lets an attacker capture the code, impersonate the customer, and complete unauthorized transactions. The control is weak wherever the secret travels through the same channel attackers can manipulate.

Q: How do security teams know whether chatbot controls are actually working?

A: They need evidence from both adversarial testing and production monitoring. The useful signals are attack success rate, tool-call anomalies, refusal spikes, response drift, and whether sensitive data patterns still appear in outputs. If the system only looks safe in a test corpus, the control is not yet operationally reliable.

Q: When should organisations step up beyond SMS-based verification?

A: They should step up whenever the contact channel has short SIM tenure, unusual line type, recent number changes, or other signs of weak trust. Those conditions indicate that the authentication path is fragile and may not support high-value or high-risk transactions.

Technical breakdown

How SMS pumping converts verification into a billable attack path

SMS pumping works by exploiting the trust boundary between account creation and message delivery. A bot creates or submits large volumes of identities, the business triggers an OTP or verification message, and the telecom network carries the cost even when the recipient is fake. The attacker profits from premium-rate arrangements, while the institution absorbs the message volume and the operational fallout. The security flaw is not message authenticity, but the absence of upstream controls that decide whether a verification request should be issued at all.

Practical implication: move controls before message initiation, because once the SMS is sent, the cost is already committed.

Why CAPTCHAs and static rate limits fail against modern bot pressure

Traditional CAPTCHA checks and simple throttles are weak against coordinated automation because they assume a small number of obvious abuse patterns. The article notes that modern bots can adjust timing, frequency, and volume, which makes them harder to distinguish from legitimate traffic at the edge. That means fraud teams need controls that evaluate behaviour in context, not just a single challenge or a per-session threshold. The relevant governance question is whether the control can recognise attack scale before the verification workflow becomes a telecom expense event.

Practical implication: validate that bot controls inspect behaviour before OTP issuance, not after volume spikes have already hit the carrier.

Why MFA delivery needs fraud governance, not just authentication policy

SMS OTP delivery is often treated as an authentication convenience layer, but in this attack pattern it becomes a financial exposure point. The institution is not only verifying identity, it is paying for every failed or malicious attempt to verify. That makes the control a hybrid of IAM, fraud prevention, and operational risk management. When regulators view repeated SMS abuse as a preventable control failure, the issue becomes less about message format and more about whether the organisation can prove it actively governs the delivery channel.

Practical implication: classify SMS verification abuse as a fraud and operational risk problem, not solely as an authentication design issue.

Threat narrative

Attacker objective: The attacker’s objective is to extract revenue from premium-rate SMS traffic while shifting the cost burden to the target organisation.

1. Entry begins with automated account creation or number submission at scale, often driven by bots or click farms that can generate large volumes of verification requests.
2. Credential or delivery abuse occurs when the business sends OTP or authentication texts to premium-rate numbers, creating monetised message traffic for the attacker and colluding carrier.
3. Impact follows as the organisation receives an inflated telecom bill, operational disruption, and potential regulatory scrutiny for inadequate fraud prevention.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS delivery is no longer a neutral MFA channel: The article shows that verification texts can be converted into a monetised abuse path when request volume is attacker-controlled. That shifts SMS from a simple authentication dependency into a governable financial exposure. For practitioners, the key question is whether delivery cost is being monitored with the same seriousness as access success rates.

Bot pressure changes the control objective from authentication to initiation control: Once attackers can cheaply create accounts and trigger OTPs at scale, the meaningful control point is not whether the code is valid but whether the message should be initiated. Static CAPTCHA and threshold logic assume low-volume misuse, which is exactly the assumption adversaries exploit. Practitioners should therefore evaluate controls at the point of request formation, not only at the point of user challenge.

SMS toll fraud is a fraud and resilience issue, not just an IAM issue: The article correctly ties the abuse to financial loss, operational disruption, and regulatory exposure. That combination places the problem across identity operations, fraud operations, and business continuity, which is why fragmented ownership leaves gaps. Teams should treat repeated verification abuse as a cross-functional risk with measurable business impact.

Identity verification channels now carry cost-bearing trust debt: When an identity workflow depends on paid delivery to external carriers, every unauthorised request creates accumulated exposure that is invisible until billing arrives. This is not merely a noisy channel problem; it is a governance deficit in how delivery trust is priced, monitored, and bounded. Practitioners should recognise that the channel itself has become part of the attack surface.

Financial institutions need telemetry that distinguishes genuine authentication from monetised automation: The article points to adaptive risk-based approaches because attackers can vary timing and frequency to evade static controls. That means the programme must separate legitimate authentication demand from behaviour intended to generate carrier charges. The practical conclusion is that SMS verification should be governed as a measurable abuse surface, not a default fallback path.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Identity verification should be governed as a cost-bearing workflow: Once SMS becomes a monetised channel for adversaries, the programme has to measure initiation abuse, not only authentication success. The operational signal that matters is whether the business can stop fraudulent demand before the carrier invoice appears.

A resilient IAM programme will distinguish between authentication assurance and delivery-channel exposure. That distinction matters because attackers do not need to break the OTP itself if they can force the organisation to pay for repeated attempts.

Adaptive risk-based controls belong at the point of request formation: The strongest control posture is the one that denies abusive SMS requests before they leave the business boundary. In practice, that means pairing fraud telemetry with IAM and treating verification traffic as a managed abuse surface.

For practitioners

• Implement pre-send bot detection Screen account creation and verification request patterns before any SMS is generated, and block high-risk flows before the carrier is engaged.
• Reduce dependence on SMS as a fallback factor Review whether high-risk journeys can move to stronger alternatives for step-up authentication and reserve SMS for lower-risk use cases.
• Add carrier-cost monitoring to fraud operations Track message spikes, premium-rate destinations, and verification failure rates together so finance, IAM, and fraud teams can see abuse quickly.
• Tune rate controls around initiation volume Set thresholds on SMS request initiation, not just login attempts, because attackers often vary timing to bypass simple throttles.
• Classify verification abuse as an operational risk Assign ownership across identity, fraud, and security teams so repeated SMS abuse is handled as a business-impacting control failure.

Key takeaways

• SMS toll fraud is a governance problem because it turns verification traffic into a direct financial liability, not just an authentication nuisance.
• The article ties this abuse to global losses of more than $6.7 billion in 2021, showing that the scale is already material for financial institutions.
• The most effective control point is before message initiation, where bot pressure can be detected and blocked before the telecom network is engaged.

Key terms

• SMS Toll Fraud: SMS toll fraud is the abuse of authentication or verification flows to generate revenue from premium-rate or otherwise monetised message delivery. The attacker does not need to steal accounts or payments. The platform’s own identity traffic becomes the mechanism that produces loss.
• Premium-rate number abuse: The misuse of phone numbers that generate revenue when messages are delivered or completed. In identity workflows, this becomes a monetisation path for attackers when a platform sends verification traffic without enough pre-send risk controls.
• Bot Management: Bot management is the set of controls used to detect, challenge, and stop automated traffic that imitates legitimate users. In identity and fraud programmes, it protects login, checkout, and session flows from account takeover, scraping, and credential stuffing while preserving access for real customers.
• Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.