It is an engineering manager’s Monday morning nightmare: a $40,000 bill from the company’s SMS provider, a crashed authentication service and 100,000 failed one-time passcode (OTP) requests sent to little-known international telecom providers.
No one actually signed up. The activity was the work of bots and the cybercriminals behind them who are cashing out.
“Fraudsters orchestrate botnets to trigger millions of automated SMS verification calls or texts to phone numbers they control in collusion with corrupt telecom operators, splitting the high per-message payout,” explains Manju Kumari, Sr. Fraud & Risk Manager at TaskUs.
The scheme is known as international revenue share fraud (IRSF). Attackers partner with or set up rogue telecom providers in high-tariff regions, then route fake traffic to premium rate numbers that pay back a share of every charge. The resulting flood of fake messages is called artificially inflated traffic (AIT).
“While IRSF serves as the broader criminal framework, SMS pumping functions as the precise mechanism employed to carry it out,” Manju says. The scheme itself is not new. Tracing how it evolved explains why the usual defenses keep failing.
How IRSF evolved from phone hacking to SMS pumping
The scam started in the office phone era. Hackers broke into corporate private branch exchange (PBX) phone servers overnight and used them to place stream calls billed to the company, usually overnight when no one was watching. This damage was real but finite since a server can only carry so many lines at once.
The shift to digital verification removed that limit. “Businesses added unauthenticated ‘Send SMS’ OTP triggers to public web forms, exposing the triggering mechanism directly to the internet,” Manju says. “Fraudsters no longer needed to compromise a phone server. Any script that could submit a form could make the platform send, and pay for, an outbound message.”
Today, botnets are able to flood exposed forms with premium numbers. There’s no line capacity to hold them back, so attackers can generate tens of thousands of dollars in losses within hours, according to Manju.
Which industries are most targeted by SMS pumping fraud?
“The scale of IRSF and SMS pumping has escalated from a minor annoyance into a worldwide, multi-billion dollar enterprise,” Manju says. Data from Mobile Ecosystem Forum underscores the magnitude of the crisis: AIT accounts for up to 40% of international application-to-person (A2P) traffic.
Platforms built on phone-first onboarding or mandatory two-factor authentication (2FA) are the most exposed, but they are not alone. Fintech companies and digital banks see their 2FA passcodes, transaction approvals and identity verification steps heavily targeted.
“Beyond direct messaging costs, these attacks corrupt user data analytics, skew conversion metrics and trigger false positives in anti-money laundering (AML) monitoring systems,” she says.
E-commerce sites and marketplaces are exposed through checkout forms, promo code validations and guest registrations. The added cost erodes thin retail margins, and merchants who disable phone verification during high traffic sales events to contain it often open the door to promo abuse instead.
Delivery, ridesharing and logistics apps depend on rapid driver and rider verification. Botnets target their sign-up endpoints in non-core regions, draining funds meant for onboarding legitimate drivers.
3 challenges and solutions to prevent SMS pumping
According to Manju, protecting platforms against IRSF means balancing tight financial risk controls with seamless user onboarding. Engineering and risk teams typically deal with three main challenges.
Challenge 1: Stopping bots before the API call
“By the time your SMS gateway triggers a message, the financial cost is already incurred,” says Manju. “The fraud has to be identified before the backend makes that outbound call.”
The solution: She recommends integrating client-side device fingerprinting, honeypots and behavioral analytics directly into registration forms. Isolating headless browsers and automated scripts at the input stage prevents fraudulent API calls from executing at all.
Challenge 2: Scoring phone number and destination risk
Not every phone number carries the same risk. High-risk corridors, unallocated ranges and virtual numbers account for most IRSF traffic, but scoring that risk in real time across global carriers requires continuous intelligence.
The solution: Implement real-time pattern detection and velocity monitoring across phone number inputs.
“Deploying rule-based policies alongside predictive machine learning models allows engineering teams to dynamically flag velocity anomalies across specific country codes, Mobile Network Codes (MNCs) and virtual number ranges before triggering a text,” explains Manju.
Challenge 3: Blocking fraud without blocking real users
Aggressively blocking country codes or enforcing rigid CAPTCHAs creates friction for legitimate customers, increasing drop-off rates and damaging customer satisfaction (CSAT).
The solution: Combine automated risk scoring with flexible escalation paths. Manju suggests, “When automated systems flag an ambiguous user request, route the edge case through secondary step-up verification or real-time human triage to help ensure legitimate users get onboarded without exposing the platform to automated exploits.”
Treat authentication as a financial gateway
The move from compromised PBX systems to botnets targeting web APIs shows how quickly attackers adapt. “As long as the telecom industry supports revenue sharing for premium routing, SMS pumping will remain a highly lucrative attack vector,” says Manju.
Absorbing these losses as a cost of doing business, or relying on basic rate limiting, is no longer sustainable. Layering pre-API bot detection, real-time telephony risk intelligence and dynamic circuit breakers that cap SMS spend during traffic spikes removes what fraudsters are ultimately after: their return on investment.
The Monday morning bill is only the most visible cost.
“Defeating modern Artificially Inflated Traffic requires a paradigm shift: treating authentication endpoints not just as UX features, but as high-risk financial gateways,” Manju says. “Securing the onboarding flow is about more than just stopping a massive telecom bill. It is about protecting the integrity of your platform and ensuring a frictionless, trustworthy experience for genuine users.”
