Home / Knowledge hub / SMS pumping
Knowledge hub
SMS pumping
Triggering paid text messages in bulk so you pay while the attacker is paid.
What it means
SMS pumping, also called artificially inflated traffic, is abuse of any feature that sends a text message, such as a sign-up code or password reset. The attacker triggers huge numbers of messages to numbers they control, and you pay your messaging provider for each one.
The attacker profits because some telecom routes share revenue with the owner of the destination number. Your form, with no limit on how many codes it sends, becomes the machine. A script sends requests, your provider sends texts, and the attacker's route collects its cut.
Why it matters
The cost shows up as a surprise bill. A flow that normally sends a few hundred messages a day can send many thousands overnight, and providers generally charge for each message sent whether or not a real person was involved. Your budget carries the loss.
Genuine users suffer too, since spend caps or provider blocks can stop their codes arriving. The cause is a missing limit on an open endpoint, the same class of flaw as unrestricted resource consumption, and it is often a form of API abuse.
How it shows up
You meet it wherever an unauthenticated request can trigger a text: phone verification at sign-up, one-time codes at login, password reset, and 'send me a link' forms. The repeated weaknesses are no limit per number, per client or per country, no check before sending, and no alert on volume.
Layer the controls. Limit sends per number and per client, restrict countries you do not serve, require a challenge before the first message, use a provider's fraud tools, and set a spend cap with an alert. To test, request many codes to many numbers and see where something refuses.
Questions people ask
SMS pumping, answered
Why would anyone want to send texts to themselves?
Because some telecom routes pay a share of the revenue to the owner of the destination number. The attacker sets up numbers on those routes, triggers texts to them through your app, and receives part of what you pay.
Is SMS pumping the same as a denial-of-service attack?
No, though the effect on your bill can feel similar. A denial-of-service attack aims to make a service unavailable. SMS pumping aims at money, by making your app send paid messages. Both exploit a missing limit.
How do we spot SMS pumping?
Look for a sudden rise in codes sent, a large share going to a few countries or number ranges, and many requested codes that are never entered. A low conversion from sent to verified is the clearest sign.
Does a CAPTCHA stop it?
It raises the cost of the abuse, but it is not enough by itself. Pair it with limits per number and per client, country restrictions, and a spend alert. Check that the challenge sits before the message is sent.
Should we stop using SMS codes?
Not necessarily. Many customers expect them. Treat the sending endpoint as a costly resource: protect it with limits and alerts, and offer an authenticator app or passkey where you can, since those do not cost per message.
Sources
Where this comes from
Related
Terms that sit next to this one
Unrestricted resource consumption
API calls that can use unlimited CPU, memory, money or third-party credits.
API rate limiting
Capping how many calls a client can make so abuse and cost stay bounded.
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
2FA bypass
Getting past a second sign-in step by exploiting how it is built or enforced.
API abuse
Using an API as designed but at a scale or in a way that harms you.
What can one form make you pay?
Any endpoint that sends a message costs money, and we test whether it can be triggered without limit. We report the requests that prove it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.