SMS pumping is toll fraud that inflates text message traffic, often by abusing verification sends, so someone else is billed.
The attacker does not need the content of the messages, because the harm is the volume and the charges it creates.
How it works
A public form or an app feature that sends a text can be called over and over, sometimes toward destinations that cost the sender far more than a local message.
The application owner pays the bill, and the route that profits may sit far from the form.
This article does not explain how to choose routes, prices, or destinations.
Operators should cap sends, watch spend, and stop features that can be triggered without a real user waiting for a code.
Concrete examples
- A signup form sends thousands of verification texts in an hour to numbers nobody at the company recognizes.
- The monthly message invoice jumps while the count of real account creations stays flat.
- A test endpoint left open on the internet becomes a hose for outbound texts overnight.
Protective measures
- Cap how many texts one address, one account, or one number can trigger in a short window.
- Alert on sudden spend and on destinations that are new in your traffic, and pause sending when the curve spikes.
- Require a completed human or computational check before a verification text is sent.
- Close unused send features and test endpoints so they cannot be called from the open internet.