SMS pumping — also called AIT, artificially inflated traffic — is fraud aimed at your balance rather than your data. An attacker drives verification codes to number ranges they control or profit from, collects a share of the carrier termination fee, and leaves you the bill.
There is nothing to steal from you and no account to break into. The send is the attack.
Why it is so effective
It is unusually cheap to run and unusually expensive to absorb. A handful of numbers, cycled patiently, quietly consumes a real budget — and because every individual request looks like an ordinary signup, it clears the checks most teams have.
Most teams discover it the way it was discovered here: as a line item on the provider bill, weeks later.
Why the obvious fixes don't hold
Each of these is a real control a real team has shipped, and each gets walked past:
- Cap attempts per account — the attacker registers another account.
- Cap attempts per phone number — they never reuse a number.
- Block the abused country — they rotate to the next dial code within a day.
- Read the provider's own attempt counter — evaluating it costs a billed message. You are paying to learn you are being robbed.
- Rate limit per IP — a distributed actor spreads across addresses and stays under every per-address cap.
The pattern underneath all five: any single-key counter can be defeated by rotating that key. Accounts, numbers, countries and addresses are all cheap for an attacker to change.
The fix is a pre-send decision
The cure is to decide before you hand the message to your provider — so a rejected attempt is a message that is never priced. That is exactly what Verifence does: one HTTP call that answers allow or deny in single-digit milliseconds, combining destination-shape checks, multi-key velocity, and a pooled network-reputation signal no single tenant can build alone.
A deny costs you nothing. That is the whole point.