SMS pumping is fraud where attackers submit your phone verification form at scale, often to premium or fraud-linked destinations, so you pay for each text that no real customer wanted. You stop it by limiting sends per number and IP, restricting countries, adding friction before the send, and watching cost and volume.
Definition
SMS pumping is also called artificially inflated traffic. One messaging provider describes it as a deceptive practice where fraudsters generate fake SMS traffic to inflate costs. The target is usually any form that sends a text when someone submits a phone number: sign-up, login, password reset or a "get the app" link.
The key point is that the attacker does not need to read the message. The harm is the charge for sending it. That makes it a billing and availability problem as much as a fraud one.
Why your sign-up form is the target
Every unauthenticated endpoint that costs you money per request is a candidate. A text verification flow has three traits that attackers like. It is public, it is cheap to automate, and each call has a direct per-message cost on your side.
Normal rate limiting often misses it because the traffic is spread across many source addresses and many numbers, each used only a few times.
Controls that help
| Control | What it does | Watch out for |
|---|---|---|
| Per-number and per-IP limits | Caps how many codes one number or address can trigger in a window | Attackers rotate both |
| Wait time between resends | Slows retries on the same number | Keep it short enough for real users |
| Country allow list | Turns off destinations you do not serve | Review it when you expand |
| Number risk checks before sending | Scores a number, then adds friction, switches channel or blocks | Scores are provider-specific |
| Bot friction before the send | Stops scripted submissions earlier | Accessibility and false blocks |
| Spend and volume alerts | Catches a spike while it is small | Needs a baseline |
Most of the public guidance comes from messaging providers who also sell protection, so test any effectiveness claim against your own traffic rather than taking a quoted percentage as given.
Steps to take this week
- Find every endpoint that sends a text and list who can call it without logging in.
- Add a per-number and per-IP limit, plus a cool-down between resends.
- Switch off countries you do not sell to.
- Put a bot check ahead of the send, not after it.
- Set an alert on messages sent per hour and on daily spend, and decide who gets paged.
- Where it fits, offer an authenticator app or email code as an alternative, since neither carries a per-text cost.
Keep a log of the number, country, IP and outcome for each request. After an incident, that log is how you tell a campaign from a busy launch day.
Where Safeguard fits
Safeguard's API security scanning and policies can help you find unauthenticated endpoints that trigger costly actions, so they show up in a review rather than on an invoice. You can start with the free scan at https://gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is SMS pumping the same as a data breach?
No. Nothing is stolen. The loss is the cost of messages you send and the load on your systems.
Does a CAPTCHA fix it?
It raises the cost for attackers but is rarely enough alone. Combine it with send limits, country controls and spend alerts.
Should I drop SMS codes entirely?
Not necessarily. Many teams keep SMS as an option but make it the last choice and cap it tightly. See why SMS codes are a weak second factor.
Sources
Last reviewed: 19 October 2026.
