SMS pumping: bots that turn your one time codes into their revenue
Why login and signup forms are the target
Any feature that texts a code on demand is a payout machine if it lacks friction: login OTP, signup verification, password reset, order tracking links, back in stock alerts by text. The bot does not need to complete the flow. The send is the monetisable event, so the attack stops at step one and repeats it at scale, usually against international prefixes where termination rates are high and oversight is low.
The traffic pattern gives it away once you look: code requests concentrated on a few country codes your customers rarely use, number ranges in tight sequential blocks, requests at a steady machine pace around the clock, and a completion rate near zero, because nobody on the other end ever intended to type a code back.
The bill arrives before the understanding
Most stores meet this attack as a finance question. The messaging invoice jumps, the provider's dashboard shows sends, and every send is real in the narrow sense that a message left the platform. Providers vary in how much pumping traffic they detect and credit. The contract and the provider's fraud tooling decide who eats the cost, which is why the time to read the artificially inflated traffic clause is before the invoice, not after.
Separate your sends by country and by flow in reporting from day one. Pumping hides inside a global total. It cannot hide in a per country view of a single form, where one odd prefix suddenly accounts for half your login codes.
Friction that stops pumping without punishing customers
Rate limit by number, by device, and by network, and make the limits per flow, so a pumping run against signup cannot ride the allowances meant for login. Add a proof of work or a bot check before the send, not after it: the entire economics depend on the send being free to trigger. Restrict destination countries to the ones you actually serve, with a deliberate process for adding more, because an open world selector on a code form is an invitation written in 200 country codes.
Voice fallback and authenticator options reduce your dependence on SMS codes generally, which shrinks the attack surface as well as the bill. SMS remains the weakest mainstream second factor and the only one that pays attackers to abuse it. Treat every send as a purchase, because to your provider, it is one.
Related reading: How do bots exploit backorder and pre-order queues?, How do loyalty point bots drain rewards programs?.
Frequently asked questions
How is SMS pumping different from credential stuffing?
Credential stuffing tries combinations to break into accounts, and the messages or requests are a means to that end. Pumping does not care about accounts at all. The message itself is the product being sold, and the attack succeeds the moment your system sends it, whatever happens next.
Which numbers do pumping bots use?
Typically ranges in high termination rate destinations, including premium or revenue share arrangements and small carriers with weak controls. The numbers may never be answered and nobody reads the codes. Volume and destination, not engagement, are what the operator is paid on.
Will a CAPTCHA on the form stop it?
It raises the cost per send, which is the right direction, because pumping margins are thin and volume dependent. Combined with per number and per country limits and destination restrictions, it usually makes a form unprofitable to pump. On its own, with solving services as cheap as they are, it slows rather than stops a determined run.
Can my messaging provider block pumping for me?
Many providers run detection for known pumping ranges and velocity patterns, and some offer country level controls and spend caps in the console. Enable them, set the caps, and ask specifically about artificially inflated traffic protection and credit policy. If the answers are vague, that is an answer.