The fraud known as SMS pumping occurs when fraudsters exploit a phone number input field on your application to receive codes sent via SMS.
The fraud involves your application (web or mobile) being used to send thousands of SMS messages to numbers controlled by a specific mobile network operator (MNO), which allows fraudsters to receive a portion of the revenue generated by sending these SMS messages.
The main impact for you and your company is financial, as you have to pay for the massive sending of these SMS messages.
The MNO is complicit and has a revenue-sharing agreement with the fraudsters.
The MNO is exploited unknowingly by fraudsters. For example, fraudsters create a fake company, which enters into a partnership with the MNO with the aim of bringing them subscribers and traffic. The MNO might not be concerned with the origin of the traffic and unknowingly support the fraud.
In both situations, this type of fraud is more likely to occur with relatively small MNOs.
It is important to implement a cost alert mechanism on the service you use to send SMS messages, so that you can quickly realise that your SMS sending costs are unusually high.
To support the hypothesis of an SMS pumping attack, two main criteria should be considered:
It should be noted that SMS pumping does not necessarily occur with numbers from very distant countries. SMS pumping attacks via UK-based numbers, for example, are often observed.
In 2023, Twitter removed
two-factor authentication by SMS to avoid SMS pumping attacks. It is therefore not straightforward to protect against this type of attack. However, several measures can be implemented and, collectively, enable you to significantly reduce fraud:
Block sending SMS to countries not expected to use your application
Add a captcha to your form and validate the captcha when sending the SMS code
Utilise a fraud protection service offered by your SMS sending service, such as
Verify Fraud Guard in case you are using Twilio
Limit the number of SMS messages that can be sent to the same phone number (however, attackers are likely to use a large number of different numbers)
Good luck in your fight against SMS pumping!
_ZRNfyf.webp)
