SMS pumping turns your phone verification into someone else's income. A bot types phone numbers into the form that sends a one-time code, at volume, and the numbers belong to a range a mobile operator controls. Each text you pay for earns that operator a fee, and the attacker takes a share of it. Twilio describes it this way, and also calls it SMS toll fraud. Nothing is stolen from your users; the loss is your SMS bill.
How SMS pumping works
Any public form that sends a text is a target: the sign-up that verifies a phone, the login that sends a code, a "text me the link" button, a chatbot that answers by SMS. Twilio names one-time codes, sign-up flows, notification triggers and chatbot endpoints. The operator may be in on the scheme, with a revenue-sharing deal, or may be used without knowing.
The bill can be large. Twitter's owner said in December 2022 that the company was losing about $60 million a year to SMS pumping through 390 telecom operators. That is his claim, not an audited figure, but it shows what a large sign-up form is worth to an attacker.
The signs
- Texts to countries you do not serve. Codes sent to places where you have few or no customers.
- Codes nobody enters. Twilio's tell for one-time codes: the verification is never completed.
- Numbers in a row. Many messages to a block of adjacent or similar numbers.
- Spend without growth. SMS costs that rise with no rise in sign-ups that convert.
What your SMS provider can do
Your provider sees the message as it leaves, so start there. Twilio's advice: turn off SMS to the countries you do not serve, limit messages to the same number range, send only to mobile numbers after a line type lookup, and turn on its fraud guard, which blocks a suspicious destination prefix, such as a country your account has never texted before. It has a cost: Twilio states its false positives stay under 1% at the standard level and under 2% at the strictest. These controls act at the send, after your form has already accepted the request.
Stop the request before the code is sent
The text costs money only once you send it, so the cheapest place to stop pumping is the request that asks for it. Twilio itself suggests protecting every form that triggers an SMS, and a delay between code requests from the same number or IP address. Bot Protection judges that request on your server, before you call the SMS provider:
- On the post that sends the code, ask for proof that your page was really visited: a script that posts phone numbers to your API without loading the page is challenged, whatever its class.
bot_high: send nothing. With the decoy answer turned on, your server answers as if the code were sent and sends none, so the bot has no reason to change its script.bot: the challenge page first, and the code only after it.unknown,human,human_high: send the code.
The two layers add up: Bot Protection stops the bot at your form, and the provider's guard catches what still reaches the send.
Measure it before you block
Start in monitor mode. Nobody is stopped, and each answer says what block mode would have done, so you can compare the requests it would have refused with the codes that were never entered. When the two line up, turn on block mode. If you also hand out free credits at sign-up, see free trial abuse: the same bots often want both.
Keep it fail-open
A code that never comes locks a real person out of your product. Use a short timeout and send the code on any error: a few pumped texts during an outage cost less than a sign-up that stops working. More in why a bot check must fail open.
Sources
Checked on 28 October 2026.