What is SMS pumping and how do you spot it?

In SMS pumping, somebody has verification codes sent en masse to numbers in expensive destinations, in order to earn a share of the traffic. You pay the bill.

How to spot it

A sudden rise in requests from countries where you have no customers. Many requests that never lead to a completed registration. And usage that peaks at night.

Why it goes unnoticed for so long

Nothing is hacked and nothing breaks. Your application works exactly as designed, just too often. Without a usage alert you only see it on the invoice.

What you do against it

Limit destinations to those where you genuinely have customers. Limit requests per number and per visitor. And only allow a second request after a waiting period.

If it happens

Close the destinations, notify your provider and review the pattern together. The sooner you spot it, the smaller the damage — and that depends entirely on whether you measured anything.