SMS pumping

What SMS pumping means in practice

SMS pumping is a fraud pattern that turns ordinary verification traffic into artificial volume. The attacker, or a fraudulent integrator, repeatedly triggers SMS sends so the organisation absorbs message charges, delivery fees, or downstream settlement costs. The same pattern often exposes a deeper design weakness, because the business has allowed SMS to carry high-trust workflows that can be monetised through abuse.

The abuse is usually easiest where the sending flow is open to large bursts, low-friction signup attempts, or repeated resend behaviour. Even when the direct loss is “just” messaging spend, the underlying issue is that the organisation has created an externally triggerable cost centre and tied it to a trust channel that users and systems treat as routine.

Why SMS verification flows are a target

Verification and login journeys are attractive because they are designed to be reachable, fast, and reliable. Those same properties make them easy to weaponise at scale. If a system lets an unauthenticated user request codes, resend them, or probe many destinations without strong pacing, the flow can be used to generate traffic without needing to compromise an account first.

For identity programmes, the danger is not limited to billing abuse. SMS is often treated as a fallback or step-up channel for recovery and access decisions, so attackers benefit twice: they can impose cost and test whether the organisation still trusts a channel that is weak against interception, number recycling, forwarding, and telecom abuse. The Phone Number Fraud guide covers the abuse pattern where OTP and phone-verification endpoints are deliberately driven into loss-making traffic.

How organisations identify exposure

Exposure starts with knowing where SMS is used, who can trigger it, and which destinations are allowed. Organisations should inventory every login, recovery, enrolment, and step-up workflow that can send a text, then map which applications, APIs, and regions can originate those requests. That inventory matters because SMS pumping is often distributed across many small entry points rather than one obvious gateway.

Two practical signals usually reveal the problem: unexpected message spikes and a poor conversion rate from sent messages to successful user actions. A high send count with very low completion suggests artificial traffic, test abuse, or destination abuse rather than normal user activity. The OWASP API Top 10 API4 Unrestricted Resource Consumption Guide is useful here because SMS pumping often behaves like a consumption problem, even when the underlying channel is not a classic API.

Controls that reduce abuse and cost inflation

The most effective controls shrink both reach and economics. Destination policy, geo fencing, per-number pacing, per-identity quotas, resend limits, and spending caps all reduce the attacker’s ability to turn requests into cost. In higher-risk environments, it also helps to separate low-trust enrolment from stronger recovery paths so a phone number cannot be used as a blanket trust anchor for every decision.

Controls work best when they are paired with fraud monitoring, because the attack often stays below a simple outage threshold while still creating meaningful cost. Watch for destination clustering, repeated retries to the same ranges, new-account bursts, and traffic that is concentrated in countries or carrier segments that do not match normal user behaviour. Where verification is only one possible path, prefer stronger authentication methods for sensitive recovery and step-up flows so SMS is not the sole gatekeeper for access.

Risk and Threat Considerations

SMS pumping creates a compound risk: direct financial loss, degraded service economics, and weaker assurance around phone-based verification. The same traffic pattern can be used to probe which numbers are active, which flows are reachable, and how quickly an organisation responds to abnormal send behaviour.

Failure mechanism: An attacker repeatedly triggers SMS sends through public or lightly protected verification endpoints, causing artificial volume, delivery charges, and operational noise while masking abuse as normal user activity.

Impact: The organisation absorbs avoidable spend, legitimate users may experience delays or rate limiting, and any workflow that still treats SMS as a trusted recovery or step-up channel inherits a fraud-prone dependency.

Practitioner Guidance

Why practitioners should care: SMS pumping is one of the clearest examples of a small input generating outsized cost. If verification flows are open to anonymous or repeated triggering, the business is effectively subsidising abuse.

What to watch for: Treat repeated resend activity, unusual destination geographies, and low completion rates as control failures, not just fraud metrics. The most useful review question is whether SMS is being used because it is genuinely appropriate, or because it is the easiest path to ship.

Practitioner takeaway: The goal is not to eliminate SMS everywhere, but to stop it being a cheap, high-volume trust primitive that attackers can monetise at scale.

Related resources from NHI Mgmt Group

• How should security teams stop SMS pumping before OTP messages are sent?
• Who is accountable when SMS pumping drives fraud losses in a marketplace?
• How should security teams reduce SMS pumping without hurting signup conversion?
• Who should own SMS pumping risk in an organisation?