SMS pumping: the fraud that targets your signup form

On 20 December 2022, in a discussion on Twitter Spaces, Elon Musk said that "Twitter was being scammed to the tune of 60 million dollars a year for SMS texts, not counting North America". The mechanism, as he described it, was telcos "running, like, two-factor authentication SMS texts over and over again" through "a zillion bot accounts", so that Twitter paid for verification codes that no human had asked for. He said he'd told the team to "cut off any telco where the fraud's above 10 percent", and that "that turned out to be a lot: 390 telcos". Two months later, on 18 February 2023, a user tweeted that Twitter was changing its two-factor policy "because Telcos Used Bot Accounts to Pump 2FA SMS" and was "losing $60 million a year" on it, and Musk replied "Yup". From 20 March 2023, the company said, "only Twitter Blue subscribers will be able to use text messages as their two-factor authentication method".

Twitter's own explanation, in the blog post the announcement linked to, was that phone-number-based two-factor authentication was being abused by "bad actors". That's the biggest public example of a fraud the industry calls artificially inflated traffic, or SMS pumping. Any web form that sends a text to whatever number is typed into it is a target, and most businesses with a signup page have one.

How the money moves

The GSMA's description is the short version. Artificial inflation of traffic is "a type of SMS fraud seeking to generate high volumes of fake traffic via mobile applications or websites and then profit from higher revenue from the artificially-generated SMS traffic". Its example is the one that catches most victims: "the fraudster exploits application-to-person (A2P) SMS verification, where a one-time password is sent to verify users' phone numbers during the registration process, then takes a share of the profits from the traffic, while the enterprise incurs inflated A2P SMS costs without added value".

Where does the profit come from? Twilio's glossary explains the two arrangements. In the first, "the MNO is complicit in the scheme and has a revenue sharing agreement with the fraudsters": the mobile operator that owns a block of numbers gets paid for every message that terminates on it, and it hands a cut to whoever generated the traffic. In the second, the operator doesn't know. "Smaller MNOs get paid by larger MNOs for subscribers and traffic", so a fraudster can set up as a fake company promising traffic to a small operator, collect the per-message payment, and let the operator believe it has a thriving reseller. Sinch's glossary adds the detail that makes the traffic hard to spot from the sending side: the bot "creates fake accounts, which triggers one-time passcode SMS messages", and "a rogue party intercepts this traffic without delivering the messages to the end user", so nobody ever complains about an unwanted text. "Together, they claim the revenue, share the profits", and the cycle repeats.

Enea, which sells a messaging firewall, published a taxonomy with the messaging intelligence firm Mobilesquared in February 2024 that splits the fraud by where it enters the chain. "Counterfeit fabrication" is traffic injected in transit by aggregators. "Amplification bot generation" is "traffic created by triggering one-time-passwords and other message-generating triggers at brand websites and services", which is the form-pumping that hit Twitter. "Masquerade parasite generation" is traffic injected through accounts created at messaging providers themselves. For a business with a signup form, the middle one is the threat, and the lesson of the other two is that your provider's own defences matter as much as yours.

What it costs

The same Enea and Mobilesquared report put a size on it. Its press release of 14 February 2024 says that "between 19.8 billion and 35.7 billion fraudulent messages were sent in 2023", that brands incurred "costs of $1.16 billion due to fraudulent messages", and that fraudulent messages "now account for a notable portion of total international traffic (4.8%)". The release is candid about the limits of the exercise: "there is still no consistent or comprehensive definition for AIT or detailed descriptions of the various methods that threat actors deploy", which is why the estimate is a range rather than a number.

Providers publish their own figures, and they should be read as what they are, a vendor's count of what its own filter caught. Twilio's blog post on SMS pumping, dated 10 September 2026, says its Verify Fraud Guard "has saved Twilio customers $62.7 million in fraudulent costs between June 2022 and October 2024" and has blocked "over 569 million fraud attempts". The Twitter figure, the Twilio figure and the Enea figure measure different things over different periods, so the chart below is three separate facts side by side.

Twitter's $60 million a year was, by Musk's account, spread across 390 telcos. A small business won't lose that. It can lose a credit pack overnight, which at its scale is the same injury.

What it looks like from your side

The traffic has a shape, and the providers describe it the same way. Twilio's glossary says "you will likely see a spike of messages sent to a block of adjacent numbers", and gives the example of +1111111110, +1111111111, +1111111112 and so on, all on one operator. For verification codes, "you will likely not see a completed verification cycle": the code goes out and nobody types it in, because nobody received it. Its blog adds the rest of the list: traffic to countries where you have no customers, spend rising while conversions don't, "sequential or clustered phone number patterns", form submissions that are incomplete or inconsistent, and an example of "50 OTP requests in a few minutes" to numbers ending 1000, 1001, 1002, 1003, 1004.

Picture it from inside a small business. A quiet weeknight. A signup form that normally gets a couple of dozen submissions a day gets thousands between midnight and three, each one a different number, each one a valid-looking mobile in a country you've never sold to, each one triggering a verification text. By morning the credit balance is gone and the delivery report is a list of numbers that were never customers. The fraud works precisely because every single message was, from the sending system's point of view, legitimate: a form was submitted, a number was supplied, a text was sent. Sinch's glossary makes the point that the fraud "may go unnoticed until message volumes are compared with projected returns", which for a small business means until the invoice or the empty balance.

Keeping a UK signup form out of it

The defences are mostly about who you'll send to and how fast. In rough order of how much each one removes:

1. Send to the UK only. Twilio's advice is to "disable all countries that you do not plan to send messages to", and for a UK business that means every country but this one. The fraud lives in destinations where a terminated message pays the operator well, and a form that can only ever produce a text to a UK mobile has nothing in it for a pumper. If your provider can't restrict the destination, do it yourself: accept 07 numbers only, normalise them to E.164 as +447, and reject the rest before any text is triggered.
2. Rate limit by number, prefix and address. Twilio's blog says to "set rate limits on messages sent to the same mobile number range or prefix", and to "introduce a delay between OTP requests from the same number or IP". A real customer asks for one code, maybe two. Ten requests from one address in a minute, or fifty to one prefix in an hour, is not a customer.
3. Put a bot check in front of the text. "Add CAPTCHA to any form that triggers an automated SMS to stop bots before they reach your messaging flows." If you'd rather not make customers solve puzzles, behavioural bot detection does the same job invisibly, and a hidden form field that a human never fills in catches the cruder scripts.
4. Count sends against completions. Verification codes that are never entered are the signature of the fraud. If your completion rate drops from 90% to 10% in an hour, stop sending and look.
5. Alert on volume. Set a ceiling for texts an hour and a day, well above your real peak, and have the system email or text you when it's crossed. An alert that only shows on a dashboard is no use at two in the morning, so have it reach a phone.
6. Ask whether the form needs to send a text at all. A verification code protects something. If the form is a newsletter signup, the text is a cost with no job, and a cost with no job is what a pumper is looking for.
7. Keep live API keys out of browsers and public code. A leaked key is a pumping endpoint with no form in front of it. Use test keys in development and anywhere a key might be seen, since they send nothing and cost nothing.
8. Check the number is a mobile before you text it. Twilio's glossary recommends sending "only to mobile numbers", using a line type lookup, and blocking carriers that may be inflating traffic. A landline or a non-geographic number in a mobile field is either a typo or a probe, and both get a polite error rather than a text.

None of this is exotic, and most of it is a day's work on a signup form. It's also cheaper than finding out the way Twitter did.

Two wider points. First, the login itself. Twilio's blog lists the alternatives for verification that don't send a text at all, "email OTPs, authenticator apps, and hardware tokens", and for a login (as opposed to proving someone owns a phone number) an authenticator app removes the SMS cost along with the fraud. Our post on one-time codes by text weighs that up. Second, your provider. Sinch's glossary lists what a messaging provider can do on its side of the line: monitor traffic for abnormal usage and tell clients, block fraud "on destination network level and MSISDN range level", put AIT clauses in partner agreements, and keep a registry of high-risk destinations. Those are reasonable questions to ask anyone you buy texts from, and the answers tell you how much of the job is left for your form to do.

CaptiFi Connect sends to UK mobiles only (the UK, Guernsey, Jersey and the Isle of Man), so a number in a high-cost destination can't be sent to from the platform at all, every new account is checked by a person before it can send, and the sent and delivered webhooks give you the counts to alarm on. The verification codes page covers the rest of the setup. Twitter's answer to its $60 million, on 20 March 2023, was to stop sending verification texts to anyone who wasn't paying it. A UK business with a UK-only sending route and a rate limit on its form doesn't have to make that choice.