What is SMS pumping?
SMS pumping (also called SMS toll fraud or artificially inflated traffic) is a scheme where attackers abuse any feature that sends a text message, usually one-time passcode delivery, to push SMS traffic toward phone number ranges they profit from. The business pays its normal per-message rate on every send. The attacker, working with a complicit carrier or reseller somewhere in the delivery chain, collects a share of the termination fees.
How it works
The attacker starts by finding an endpoint that turns a request into a text message: signup phone verification, login OTP, "text me a download link", SMS two-factor enrollment. These endpoints are attractive because they sit in front of authentication. They are reachable without an account, and teams rarely rate limit them as hard as the rest of the product.
They then script the endpoint with bots and feed it numbers from ranges where they earn revenue. Termination fees are split among the parties that carry a message to its destination, and rogue operators or resellers kick back a portion of that fee for traffic delivered to numbers they control. International destinations with high termination rates are the usual target, which is why victims often notice sudden volume to countries where they have no users at all. Twilio documents the same pattern under the name artificially inflated traffic.
The economics favor volume over stealth. A single run can generate tens of thousands of OTP sends in a few hours, often overnight when nobody is watching the messaging dashboard. No code is ever entered. For many teams, the first sign is the invoice from their SMS provider.
How to detect it
Watch the destination numbers first. Pumping runs burn through contiguous blocks, so you see sends to numbers ending 0011, 0012, 0013 within the same prefix in minutes. Real users never arrive as a sequential range. A velocity counter per number prefix, rather than per individual number, is the most useful control to maintain.
Completion rate is the second tell. Legitimate OTP flows convert. Ranges under attack sit near zero because nobody is on the other end to enter the code. Track verification completions by destination country and prefix, and alert when any segment's rate collapses.
Carrier and number-type lookups catch a lot before the send: VoIP and disposable numbers, prefixes tied to premium-rate or revenue-share operators, and destination countries outside your user base.
Then look at the requests themselves. Pumping is bot-driven, so the standard automation signals apply: headless browsers, missing or faked JavaScript execution, datacenter and proxy IPs, one device fingerprint appearing behind hundreds of "different" phone numbers, and inter-request timing too regular to be human. Bot detection and device fingerprinting cover these signals in depth. The same infrastructure that runs signup farms often runs pumping, so there is heavy overlap with fake account detection, and the endpoints involved are the same ones probed during credential stuffing.
How Rupt handles it
Rupt scores the request before the message goes out. Its bot detection flags automation on the OTP endpoint, and device identification ties bursts of sends back to a single actor even when the attacker rotates IPs and phone numbers. Gating the verification endpoint this way means a failed check blocks the send rather than the login, so real users never notice the control exists.