SMS pumping (also called SMS toll fraud) happens when attackers abuse your OTP flow to send messages to premium-rate or high-cost destinations — inflating your bill while they collect a share of the revenue.
How SMS pumping works
- Attacker finds your signup or login OTP endpoint
- They trigger thousands of verification requests to expensive routes
- Your provider charges you per SMS; attacker earns from traffic deals
- You pay the bill; attacker walks away
Detection signals
| Signal | What to watch |
|---|---|
| Spike in send volume | Sudden 10x increase in /send calls |
| Unusual destinations | Traffic to rare or premium countries |
| Failed verification rate | High send, low check completion |
| Same IP, many numbers | Bot-like patterns from single IPs |
Prevention checklist
- Rate limit per IP, per phone number, and per API key
- Country allowlist for markets you actually serve
- CAPTCHA or device fingerprint on signup flows
- Auto-blacklist suspicious numbers and IP ranges
- Pay only for successful verifications — failed sends refunded
DoneOTP includes rate limiting, brute-force lockout, auto-blacklist, and country allowlist out of the box — no add-on required.