Topic starter
10/07/2026 9:07 pm
TL;DR: SMS pumping turns verification traffic into a billing attack by abusing OTP send flows rather than stealing accounts, and industry estimates put global losses in the billions while successful verifications remain flat, according to Authsignal. The control problem is not stronger codes, but deciding when SMS should be sent at all, and when another channel should replace it.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “How to mitigate SMS pumping without breaking signup”.
Key questions
Q: What breaks when SMS verification is treated as a low-risk control point?
A: What breaks is the assumption that verification traffic is merely an operational cost.
Q: Why does SMS pumping increase both fraud risk and operating cost?
A: Because the platform pays for each message whether or not a legitimate user receives it.
Q: How can IAM teams tell whether OTP traffic is being abused?
A: Look for OTP sends rising while successful verifications stay flat, especially when requests cluster around shared prefixes, high-risk countries, or repeated retries from similar devices.
Practitioner guidance
- Implement pre-send channel policy Require a risk decision before any SMS OTP is sent.
- Set prefix-level and country-level throttles Limit repeated OTP sends by phone number, prefix, and destination country so concentrated abuse patterns are visible and can be blocked before invoices spike.
- Move returning users to passkeys Prompt passkey enrolment after successful login and make it the default for returning users, so routine verification no longer depends on a reusable SMS send path.
Bottom line: SMS pumping exploits the verification send path itself, so the main governance issue is whether a message should be sent at all.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:31 pm
SMS pumping is a verification-governance problem, not an OTP-security problem. The attack succeeds because teams often model phone verification as a benign step that only helps prove identity. In reality, the send request itself creates financial exposure and should be governed as a controlled business action, not an automatic side effect. Practitioners should treat channel decisioning as part of identity governance, not a cosmetic UX choice.
A question worth separating out:
Q: Should organisations replace SMS with passkeys or silent authentication first?
A: Where supported, yes. Passkeys remove the message-send path for returning users, and silent network authentication verifies some users without an SMS at all. The right sequencing is to remove routine SMS exposure first, then reserve it for fallback and recovery.
👉 Read our full editorial: SMS pumping exposes the trust gap in phone verification flows