You stop SMS pumping by stacking several cheap controls: rate limiting, a bot check, country filtering and a spend cap. Any one of them can be bypassed, but together they make the attack costly and slow.
The layers
- Rate limit sends per phone number, per IP and per device or session.
- Add a CAPTCHA or similar bot check before the first send on unauthenticated forms.
- Send only to countries you actually serve.
- Set a daily spend cap so a runaway attack has a ceiling.
- Alert when sends rise but verifications do not.
Order matters
Run the cheap checks first, before any request reaches the SMS provider. Reject a request that fails validation without spending anything. Also require a session or account context where you can, since a code request tied to an existing user is much harder to abuse than an anonymous one.
Tune the limits on real data. Start strict, watch legitimate users who get blocked, and loosen only where the logs justify it.
Need OTPs that reach users across Africa? Read the API docs or get a free test key.