The SMS Pumping Problem Most Businesses Are Budgeting Around, Not Solving
Picture a business running a referral campaign over a long weekend. Signups climb steadily through Thursday, marketing is pleased with itself, and then, sometime after midnight, the OTP send volume does something a normal campaign never does. It doesn't rise - it jumps, and keeps climbing. On the dashboard it looks like the campaign is working better than anyone expected. Look closer, and almost none of those codes are being entered back into the app. They're going out in tight bursts to number ranges nobody recognises, in countries the business operates in but not locally registered, and the verification rate has quietly collapsed toward zero.
That's SMS pumping - sometimes called Artificially Inflated Traffic, or AIT - and it's not a fringe problem, and it's not a fraud type unique to fintechs or OTP flows. Any established brand sending SMS internationally, particularly through routes into destinations where it isn't locally registered, is exposed. OTPs happen to make up the overwhelming majority of international A2P SMS traffic today, which is why they're the most visible place pumping shows up, but the underlying vulnerability is the international termination route itself, not the OTP use case. An attacker doesn't need to steal anything from the business directly. They just need to trigger enough sends to phone numbers they control, and let the termination fees do the rest.
Why this hits harder in African markets
A handful of mobile networks, concentrated in parts of Africa, the Middle East, and Southeast Asia, run high termination rates on international SMS and share that revenue with whoever controls the receiving number block. That arrangement is exactly what makes pumping profitable; the attacker never touches your app, your data, or your customers. They just need your international SMS traffic to fire, and they profit from what you're charged to deliver it.
It's also why the fraud disproportionately concentrates in exactly the markets where many businesses sending SMS internationally end up exposed. Industry tracking of AIT traffic patterns consistently ranks Africa as the region with the highest concentration of high-risk destinations for this attack type, ahead of Asia, the Caribbean, and the Middle East. Industry estimates put global losses from artificially inflated traffic at over $1.6 billion in a single year, with OTPs accounting for the large majority of the international SMS traffic those losses come from. That's not a reason to avoid building here; it's the reason infrastructure built specifically for these markets, rather than adapted from a global platform, actually matters.
Why it's hard to catch from the inside
The frustrating part of AIT fraud is that it hides inside traffic that looks like success. A signup spike, a campaign performing well, a form that's clearly getting used - these are the exact signals a growth team is trained to celebrate. The tell isn't volume; it's conversion - OTPs sent against OTPs actually verified. When that ratio collapses while volume climbs, you're not looking at a viral moment. You're looking at a bill.
By the time most businesses catch it, it shows up as a finance problem - a messaging invoice that's inexplicably three or four times normal - rather than a security one. The fraud has usually been running for days by then.
Where the fix actually has to live
Rate limiting and geo-restrictions on the signup form help, but they're a patch on a symptom. The more durable fix is catching this before a message ever leaves your system, and that's a delivery-layer problem, not a marketing-layer one.
This is what Signals is built to do. Every OTP, alert, and fraud check gets scored for delivery confidence and fraud risk before it fires, not after a bill spikes or a customer complains, with Fraud Guard watching for exactly the patterns that mark AIT: velocity that doesn't match organic behaviour, number ranges that are often too sequential, thereby giving away that it is an organised fraud attempt, and verification rates that don't hold up. Traffic that looks like pumping gets stopped at the gate instead of being paid for and investigated afterwards.
But stopping the fraud is only half the story, because pumping attacks don't just cost money; they degrade trust for the real customers caught in the noise around them. A genuine user whose OTP request gets briefly rate-limited during an active attack, or whose delivery slows because the system is under load, still needs to complete their login or transaction, and still needs to feel like the business had it handled. That's where Engage matters: understanding which customers are genuinely affected, and reaching them through the channel and timing that actually works for them, rather than letting a security event quietly become a churn event nobody tracked.
And when a fraud spike does generate support volume - customers asking why a code didn't arrive, or why their account was briefly flagged - Resolve is what keeps that conversation from starting cold. An agent picking up that ticket should see the same delivery and fraud context Signals already has, instead of treating it as an unexplained complaint with no history attached.
What to actually check
If you're sending SMS internationally at any real volume - for OTPs, alerts, or notifications - it's worth pulling up your own dashboard and looking past total send volume for:
-
Verification rates that have dropped even as send volume has risen
-
Traffic to number ranges or countries with no connection to your actual user base
-
Sequential or clustered phone numbers in your recent OTP logs
-
Send bursts with no matching signup or campaign activity behind them
None of these is proof on their own. Together, they're usually enough to know whether you're looking at growth or at a bill someone else is about to profit from.
See how Signals, Engage, and Resolve handle this end-to-end
Fraud Guard is one layer of a larger system. The V4 series walks through how Signals, Engage, and Resolve work together — catching fraudulent traffic before it fires, keeping genuine customers engaged through it, and giving support teams the context to resolve what comes back.