SMS pumping, also called artificially inflated traffic (AIT), is fraud where bots hit your send-code endpoint to generate paid messages to numbers in ranges where a complicit carrier or reseller shares the termination fees. You pay for every message; the attacker gets a cut.
How it hits an OTP endpoint
- An unauthenticated "send code" form is the ideal target, because it needs no account.
- Bots rotate through many numbers in a single destination range, so per-number limits alone do not help.
- Nobody ever enters the code. A high send count with a near-zero verify rate is the classic sign.
What to watch
Compare sends against successful verifications by country and prefix. A sudden spike in one range with almost no completions deserves an alert before the invoice arrives.
Figures quoted for pumping losses are mostly vendor estimates, so treat them cautiously and measure your own traffic. Tambua only charges carrier-accepted attempts, and the attempt limits and per-country pricing are visible up front.
Need OTPs that reach users across Africa? Read the API docs or get a free test key.