Every time someone requests a one-time password, your company pays for a message. Fraudsters have learned to exploit this. In an artificially inflated traffic attack, also called SMS pumping, bots request codes for large batches of numbers in high-cost destinations, and the fraud ring shares in the termination revenue those messages generate.

The result looks like growth on a dashboard and like a disaster on the invoice: thousands of codes sent, almost none entered.

Signs that you are under attack

• Sudden spikes in OTP requests to countries where you have few customers
• Sequential or near-sequential destination numbers
• A falling conversion rate between codes sent and codes verified
• Traffic concentrated outside your customers' usual hours

What to do

• Block or rate-limit destinations you do not serve
• Set limits per country, per number range and per session
• Track the verification rate and alert on drops
• Add bot protection on sign-up and login forms

The cheapest message is the one a fraudster never gets to trigger.

At US Matrix, OTP traffic runs on dedicated routes with active fraud monitoring by our 24x7 NOC. If you see unusual patterns, talk to our team and we will review your traffic with you.