TL;DR: SMS toll fraud is driving hidden losses for social media platforms that rely on SMS verification, with one company saving $3 million per month after blocking malicious bot traffic, according to Arkose Labs. The deeper issue is that verification channels built for trust can be turned into revenue leakage when bot activity scales faster than detection and rate controls.
At a glance
What this is: This article explains how SMS toll fraud and bot-driven verification abuse can turn SMS-based identity checks into a direct revenue leak for social platforms.
Why it matters: IAM teams need to treat SMS verification as a costed control surface, not just an authentication step, because abuse can be automated at scale and detected too late.
Context
SMS toll fraud is a form of verification abuse where attackers trigger outbound SMS messages to premium-rate or high-cost numbers by automating fake registrations or login flows. The identity control fails because the business pays for each message even when the request is illegitimate, so the abuse becomes a billing problem as much as an account-security problem.
For social media and consumer platforms, the issue sits at the intersection of IAM, fraud, and channel economics. SMS-based 2FA and OTP workflows are often treated as low-friction trust controls, but once bots can generate registration traffic at scale, the verification path itself becomes an attack surface with direct financial exposure.
Key questions
Q: What breaks when SMS verification is left open to bot traffic?
A: The control that breaks is the assumption that verification traffic is naturally self-limiting. Bot traffic can create a high-cost burst faster than human reviewers can react, so the business pays before the abuse is recognised. That is why verification channels need pre-dispatch abuse controls, not only after-the-fact investigation.
Q: Why do automated SMS verification attacks create outsized financial risk?
A: Because each successful request can produce an immediate charge, and attackers can generate hundreds or thousands of requests in a short burst. The loss happens at transaction time, which means even modest abuse can become expensive fast. That makes SMS verification a fraud-sensitive identity flow, not just a messaging feature.
Q: How can security teams tell when SMS verification is being gamed?
A: Look for short bursts of SMS requests, repeated retries, sequential phone numbers, partially completed forms, and requests originating from geographies where the business has little or no user base. Those signals usually indicate scripted abuse rather than genuine consumer demand, especially when registration volume rises without a matching conversion rate.
Q: Should organisations keep SMS as a default 2FA method?
A: Only when the use case justifies the fraud exposure and cost. SMS is convenient, but it is easy to automate, expensive at scale, and weak against abuse. Most teams should reserve it for trusted fallback scenarios and use stronger challenge or verification controls for routine journeys.
Technical breakdown
How bot-driven SMS pumping works
Attackers use automation to submit registration or login requests that trigger outbound SMS verification messages. The bot then abandons the flow after the message is sent, leaving the business to absorb the telecom charge. In IRSF or SMS pumping schemes, the attacker does not need account takeover or credential theft. The abuse target is the verification channel itself, which makes the economics of message delivery part of the threat model. Premium-rate destinations and colluding intermediaries can turn each verification event into monetisable traffic.
Practical implication: Model verification flows as financially exposed assets and instrument them for abuse patterns before delivery, not after bill shock.
Why rate limits alone do not stop verification abuse
Rate limiting can slow abuse, but it does not distinguish legitimate bursts from coordinated bot activity unless it is combined with behavioural and contextual signals. Indicators such as sequential phone numbers, unusual geographies, partially completed forms, and repeated retries help separate human demand from scripted abuse. The technical weakness is treating SMS as a simple messaging pipeline rather than a policy-governed trust path. Once an attacker can rotate identities and numbers faster than your thresholds, static caps become easy to game.
Practical implication: Use layered detection that combines velocity, geography, and number-quality checks instead of relying on a single request threshold.
Why reducing SMS dependence changes the security economics
The article points to a broader control shift: reduce reliance on SMS for high-volume or low-assurance verification and move to stronger bot management and challenge-based controls. That matters because every avoided SMS request removes both fraud exposure and downstream telecom cost. For IAM programmes, this is not just channel optimisation. It is a recognition that assurance, cost, and abuse resistance are now coupled in consumer identity journeys. Where SMS remains, it should be reserved for trusted use cases rather than as the default identity proofing path.
Practical implication: Reclassify SMS from a default verification method to a constrained fallback and measure its abuse rate as part of IAM governance.
Threat narrative
Attacker objective: The attacker seeks to convert verification traffic into direct revenue gain while forcing the platform to absorb the message costs.
- Entry occurs when bots submit fake registration or login requests that invoke SMS verification workflows at scale.
- Escalation happens as automated traffic uses premium-rate or high-cost numbers, turning each legitimate-looking verification into a billable abuse event.
- Impact is the accumulation of inflated telecom charges, lost margin, and reduced registration throughput for real users.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SMS verification is no longer just an authentication channel, it is a cost-bearing control surface. When attackers can trigger messages at scale, the control stops being about proving identity and starts being about controlling exposure to telecom spend. That shifts the governance question from login success rates to abuse economics. Practitioners should treat every outbound verification path as part of the identity cost model, not as a free security primitive.
Channel abuse reveals a hidden IAM blind spot: assurance controls can create direct financial liability. SMS OTP was widely adopted because it lowered user friction, but friction reduction does not eliminate adversarial scale. In consumer identity programmes, the verification layer can become the easiest place to monetise automation because the business pays after the request is accepted. The implication is that IAM teams must work with fraud and finance owners on the same risk surface.
Verification abuse is a signal that trust boundaries have moved from the account to the transport layer. The attacker does not need to defeat the user, only to induce the platform to pay for message delivery. That means identity governance has to look beyond who authenticates and ask what each authentication path costs under abuse. The practitioner response is to re-evaluate SMS as a default factor wherever bot pressure is measurable.
Cost leakage and identity abuse now converge in the same event stream. This article shows that account creation, bot management, and telecom billing are no longer separable operational domains when SMS is the verification mechanism. The field should stop treating fraud controls as downstream optimisation and start treating them as identity governance controls. Teams that own IAM without ownership of abuse economics are governing only half the problem.
From our research library:
- U.S. fraud losses are projected to reach $40 billion by 2027.
What this signals
SMS toll fraud forces IAM teams to think in cost per authentication, not just success rate. Verification flows that look efficient in normal traffic can become expensive liabilities under automation, so governance needs to measure abuse resistance alongside user friction. The right question is not whether SMS works, but how much it costs when bots decide to use it at scale.
Consumer identity programmes need a fraud-aware factor strategy. If a verification path can be weaponised to generate direct spend, it should not sit in the default path for every account creation event. Teams should reclassify SMS into constrained use cases and align IAM, fraud, and billing owners around one operating model.
For practitioners
- Audit SMS verification cost exposure Map where SMS is used for registration, login, and step-up verification, then quantify the monthly message cost attached to each flow under bot abuse.
- Add bot signals before SMS delivery Combine velocity checks, sequential-number detection, geography mismatches, and retry suppression so abuse is blocked before the message is sent.
- Restrict SMS to trusted use cases Limit SMS-based 2FA to workflows that genuinely need it and move routine consumer verification to stronger challenge and fraud controls.
- Track premium-rate destination risk Flag registrations that target international or premium-rate numbers and deny them where the business has no operational presence or justification.
Key takeaways
- SMS verification can become a revenue leak when attackers automate fake registrations and force the business to pay for outbound messages.
- The article’s examples show that the financial impact is already material, with one company reporting $3 million in monthly savings after cutting malicious bot traffic.
- The control lesson is to reduce dependence on SMS, add bot detection before delivery, and govern verification as part of the identity cost model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SMS verification abuse exploits a weak, automated authentication path. |
| NHI-10 — Human Use of NHI | Attackers use automated traffic to make a human-facing identity channel billable at scale. | |
| Recommendation — Reduce reliance on SMS authentication where bots can trigger repeated verification traffic. Separate human login journeys from automation-prone verification flows and add abuse controls. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | SMS OTP and verification controls are part of authenticator lifecycle and abuse management. |
| Recommendation — Apply authenticator management controls to limit SMS-based verification and retire weak factors. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Verification abuse changes how identity permissions are granted and used in consumer journeys. |
| Recommendation — Review authorization paths that trigger outbound verification and constrain them by risk. | ||
| MITRE ATT&CK | TA0001;TA0006 — Initial Access; Credential Access | Bot-driven SMS pumping uses initial access into registration flows and abuses verification mechanics. |
| Recommendation — Map automated registration abuse to initial access and credential-abuse patterns in detection logic. | ||
Key terms
- SMS Toll Fraud: SMS toll fraud is the abuse of authentication or verification flows to generate revenue from premium-rate or otherwise monetised message delivery. The attacker does not need to steal accounts or payments. The platform’s own identity traffic becomes the mechanism that produces loss.
- SMS pumping: Fraud that exploits SMS delivery or verification flows to generate artificial message volume and cost. In identity programmes, the issue is not only billing abuse but also the overreliance on SMS as a trust channel for login, recovery, or step-up verification.
- Premium-Rate Line: A premium-rate line is a phone service that generates payouts when messages are delivered or activity is routed through it. In toll-fraud campaigns, attackers use these numbers as the destination for high-volume SMS sends so the platform’s verification traffic is converted into revenue.
- Bot Management: Bot management is the set of controls used to detect, challenge, and stop automated traffic that imitates legitimate users. In identity and fraud programmes, it protects login, checkout, and session flows from account takeover, scraping, and credential stuffing while preserving access for real customers.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org