Use case
Reducing SMS pumping and toll fraud exposure
SMS pumping submits large volumes of phone numbers to a form or endpoint that triggers an outbound SMS, such as a sign-up OTP, then routes those numbers through premium-rate or toll destinations that share revenue with whoever generated the traffic. The sending firm is billed for every message and gets nothing in return. A number type and active status check before the send closes off the cheapest version of this attack.
How SMS pumping works
Also known as artificially inflated traffic, the pattern relies on any endpoint that sends an SMS in response to a submitted phone number: sign-up verification, password reset, two-factor enrolment. An attacker scripts submissions against that endpoint using numbers that route to premium or toll destinations, or that are otherwise set up to generate payouts through a telecom aggregator relationship. Each message the endpoint sends costs the sending firm money and produces no legitimate customer at the other end.
Where a number check fits before the send
Check numberType on any number submitted to an SMS-triggering endpoint. A toll-free number, a voicemail-only number, or a pattern of non-fixed VoIP numbers submitted in quick succession is not what a genuine customer signing up on a mobile number looks like. See number type detection for fraud.
Check active status before sending. A message sent to a number that cannot actually receive it is a wasted cost with no upside, and unusual patterns of inactive numbers submitted together are worth flagging on their own.
Any endpoint that triggers an SMS in response to unauthenticated input should be rate-limited by IP and by number, independent of any telecom signal, since pumping is fundamentally a volume attack against a cost-per-message endpoint.
Signals used in this flow
- numberType: flags number types that are unusual for a genuine sign-up or verification flow
- active: confirms the number can actually receive the message before it is sent
This sits alongside the broader pattern of screening low-cost, fast-provisioned numbers at sign-up. See blocking disposable and virtual numbers at sign-up for the wider onboarding-stage version of the same control.