SMS pumping: spot it, stop it.
Bots request SMS codes to expensive numbers, and you pay for every message. This guide shows how SMS pumping works, how to spot it in your send log, what helps and why a code your users send to you cannot be pumped.
- How the fraud works
- Signs in your send log
- Verification without sending
Christian Schätzlein, Founder and developer of Sendity
3 min read
Consecutive numbers, no code entered
Excerpt from an SMS send log (example)
-
GB +44 7700 900021 02:14:01
Code not entered Consecutive numbers, one per second.
-
GB +44 7700 900022 02:14:01
Code not entered
-
GB +44 7700 900023 02:14:02
Code not entered
-
Intl. +882 16 0000 0412 02:14:02
Code not entered International network, unusual for your audience.
-
DE +49 151 •••• 2207 09:30:10
Code entered
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
Every form that sends an SMS code on request is a button that costs you money. SMS pumping presses it automatically, thousands of times.
Who earns from it
Fraudsters control or work with number ranges for which carriers pay out a share of the termination fee. Every SMS you send there earns them money. The industry calls this artificially inflated traffic (AIT).
How bots trigger it
Scripts fill in sign-up, login or password reset forms with numbers from these ranges and request a code each time. Nobody ever enters the code.
The signs
Bursts at night, consecutive numbers, destination countries that do not fit your audience, and a falling share of codes that are actually entered.
What helps, and where it stops
Blocking countries, rate limits per number and IP, a CAPTCHA and the fraud protection of your SMS provider reduce the damage. They all filter requests, but every request that gets through still costs an SMS.
Turning the direction around
With reverse OTP, your page shows the code and the user sends it to you via WhatsApp, email or SMS. You send nothing, so there is no message a bot could trigger.
Verification without sending.
How reverse OTP replaces the outgoing SMS code.
Your page shows a code
Short-lived and tied to this one request. Nothing is sent yet.
The user sends it
Via WhatsApp or email, with the message already prepared. SMS works as a fallback.
Sendity checks the sender
Your backend receives the verified number or address as a signed result.
Sending a code or receiving one?
The direction decides who pays and who can trigger costs.
| Aspect | Outgoing SMS code | With Sendity |
|---|---|---|
| Who triggers costs | Anyone who fills in the form | Nobody: you send nothing |
| Failed attempts | Every SMS sent is billed | Cost nothing |
| Country blocks | Needed, and they block real users too | Not needed against pumping |
| Number entry | The user types the number | The number comes from the sender |
What receiving the code changes.
What happens when the user sends the code instead of you.
Nothing to pump
Without outgoing messages, bots have no button that costs you money.
Costs only on success
You pay per verified contact, not per attempt.
No country blocks
Real users abroad are not locked out to protect your SMS budget.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
SMS pumping: common questions.
Does SMS pumping affect small websites too?
Yes. The scripts look for any form that sends an SMS on request. Low volumes only mean you notice later.
Is a CAPTCHA enough?
It stops simple scripts. Attackers solve CAPTCHAs with services or people, so it reduces the volume but does not remove the risk.
What about the SMS fallback in reverse OTP?
There the user sends the SMS from their own phone and pays for it. An attacker would have to pay for every message themselves, so there is nothing to earn.
Do I have to change my sign-up flow?
The code field and the SMS sending go away; the widget takes their place. Your backend checks the signed result, as described in the developer docs.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Verify phone numbers without sending SMS.
Try the live demo on your phone. It takes ten seconds.