Every business that sends one-time passcodes pays for each message it sends. That simple fact is what makes SMS pumping fraud so frustrating. An attacker triggers thousands of verification texts to numbers they control, and the bill lands on you, not on them.
This guide explains how SMS pumping works, the warning signs to watch for, and the practical controls that cut the risk. You will also see how to design a safer OTP flow with the DataFlows OTP Verification product and API.
What Is SMS Pumping Fraud?
SMS pumping fraud is a type of abuse where an attacker artificially inflates the number of SMS messages your application sends, usually verification codes, so that someone profits from the traffic. The attacker finds a sign-up, login or password reset form that sends an OTP, then scripts thousands of requests using phone numbers that route to destinations they benefit from. Each message costs the business money, and the attacker, or a partner in the delivery chain, earns a share of the termination revenue. The codes are never used. The traffic is not real customers, and there is no genuine sign-up behind it. Because the form is public and the messages look legitimate to a basic system, the abuse can run for hours before anyone notices. It is also called artificially inflated traffic, and it targets any service that lets anonymous visitors trigger a text with no friction. The result is wasted spend, polluted data and, in bad cases, a damaged sending reputation.
Why It Matters for Australian Businesses
Australian businesses of every size now use SMS codes for sign-up, login and account recovery. That makes any public OTP form a target, whether you run a local booking site, an online store or a membership platform.
The cost is direct. Pay-as-you-go messaging means unexpected volume turns into unexpected spend. A small team without round-the-clock monitoring can lose a surprising amount overnight or across a weekend.
There is also an operational cost. Fraudulent requests fill your logs, skew conversion numbers and can lock real customers out if you respond by switching verification off entirely. A calm, layered defence is better than a panicked shutdown.
Finally, responsible messaging matters. DataFlows is an ACMA-registered Originating Telco and designs messaging around the Spam Act 2003. Keeping your OTP flow clean keeps your traffic clearly transactional and easy to explain.
Warning Signs of SMS Pumping
Pumping rarely looks like a single dramatic event. It shows up as patterns that do not match how real customers behave. Check for these signals in your logs and dashboards.
- Sudden volume spikes. OTP requests jump well above your normal hourly or daily baseline with no campaign or launch to explain it.
- Low completion rate. Many codes are sent but very few are entered. Real users almost always finish verification.
- Unusual destinations. A burst of requests to countries you do not serve, or to number ranges that look sequential.
- Repeated requests for one number. The same number, or numbers differing by a digit or two, asks for codes again and again.
- Traffic from a few IPs or user agents. Many requests share an address range, a device fingerprint or an identical browser string.
- Odd timing. Bursts at 3 am local time, or perfectly regular intervals that suggest a script.
No single signal proves fraud. Two or three together, especially a spike with a low completion rate, deserve immediate attention.
Key Benefits of Protecting Your OTP Flow
- Lower, predictable spend. Controls stop bulk abuse early, so your messaging cost tracks real customers.
- Cleaner analytics. Verification and conversion numbers reflect actual users, which helps you make better product decisions.
- Better user experience. Targeted limits block scripts while letting real people verify quickly.
- Reduced account abuse. The same controls that slow pumping also slow fake account creation and credential testing.
- Faster response. Good monitoring turns a weekend loss into a short alert and a quick fix.
Step-by-Step: Hardening Your OTP Flow
No single control stops every attacker, so combine several. Work through these steps in order, starting with the cheapest and most effective.
1. Rate limit per phone number
Allow only a small number of codes per phone number in a set period, for example three per hour. A real user rarely needs more. An attacker hammering one number hits the wall quickly.
2. Rate limit per IP address and session
Apply the same idea to the source of the request. Limit codes per IP, per device and per session. Remember that attackers rotate addresses, so do not rely on IP limits alone.
3. Add a resend cooldown
Require a gap before another code can be requested, such as 30 to 60 seconds, and make it grow with each retry. Show a visible countdown in the interface so real users understand the wait.
4. Restrict destinations by country
If you only serve Australian customers, only send OTPs to Australian numbers. Validate the number format on your server before you call any SMS API. Allow other regions only when you have a real reason to.
5. Put a CAPTCHA or challenge in front of the send
Before the first code goes out, ask the visitor to pass a CAPTCHA or similar bot challenge. This stops most simple scripts. Trigger it only when risk signals appear if you want to keep friction low for trusted users.
6. Require something before you send
Where possible, send codes only after a user has done something a bot finds costly, such as submitting a valid email address that you have checked, or after completing earlier steps of a sign-up. Avoid exposing an unauthenticated endpoint that sends a text on demand.
7. Set a short code lifetime and attempt limit
Expire codes after a few minutes and lock verification after a handful of wrong guesses. This does not stop pumping on its own, but it closes related brute-force attacks on the same form.
8. Monitor spend and completion rate
Track OTPs sent, OTPs verified and spend per hour. Alert your team when sends rise or the completion rate falls. In DataFlows, the Low Balance Alert can act as a general spend-awareness aid, since a sudden drain on your credit balance is a visible signal that something is wrong. It is not a fraud detection feature, so pair it with your own application monitoring.
How DataFlows Helps
DataFlows is an Australian platform for SMS, built around pay-as-you-go credits with no monthly or annual fees. You buy credits and top up when you need them, which keeps you in control of how much you can spend on messaging.
The OTP Verification product and the SMS API let you build the verification flow in your own application, which is exactly where the controls above belong. The checks that matter most, such as rate limits, cooldowns and CAPTCHA, run in your code before a request ever reaches the SMS API. For a developer walkthrough, read SMS verification using the DataFlows API. To get started, open the Developer section in your DataFlows dashboard to get your API Token.
If you use an identity provider or backend platform, the same thinking applies. The Auth0 integration and the Supabase integration deliver your OTP messages through DataFlows, so apply the limits that your identity layer offers, along with the ones in your own application. Our guides on configuring Auth0 OTP SMS and Supabase SMS with DataFlows walk through the setup.
Sender identity also helps your real users trust the message. A registered Sender ID shows customers who the code is from, and DataFlows registers alphanumeric Sender IDs with ACMA on your behalf.
To be clear about scope: DataFlows does not claim a built-in fraud-scoring or pumping-detection engine. The defences in this guide are design practices you apply in your own application, supported by sensible credit management.
Best Practices
- Layer your defences. Combine number limits, IP limits, cooldowns, geo checks and a bot challenge. Each one covers gaps in the others.
- Validate before you send. Check number format, country and risk on your server first. The cheapest SMS is the one you never send.
- Never expose a raw send endpoint. Keep your API Token on the server and never place it in browser or mobile app code.
- Watch completion rate, not only volume. A busy day with high completion is healthy. A busy night with low completion is a warning.
- Review spend daily. Make credit usage part of a regular check, and top up deliberately rather than automatically without limits.
- Have a response plan. Decide in advance who gets alerted, how to tighten limits quickly, and how to pause sends for a region without turning off verification for everyone.
- Test your limits. Try the flow as an attacker would, with a script, before one does it for you.
Conclusion
SMS pumping fraud turns an ordinary OTP form into a way to drain your messaging budget. The fix is not one clever tool. It is a set of sensible controls: limits on numbers and IPs, cooldowns, destination checks, a bot challenge and steady monitoring of spend.
Build these into your verification flow from day one, and your costs stay tied to real customers. Ready to build a safer OTP flow? Sign up at dataflows.com.au and explore OTP Verification and the SMS API today.