Glossary
What is SMS pumping?
SMS pumping, also called artificially inflated traffic, is fraud in which an attacker makes your app send large numbers of text messages to phone numbers they control, usually in countries with high termination fees. The attacker, or a partner in the telecom chain, is paid a share of each message, while you pay the bill. The usual target is a public form that sends a verification code.
How it works
Any page that sends a code to a number typed by the visitor, such as sign-up, login or password reset, can be called by a script. The script submits a different number each time, many of them tied to the attacker. Each text costs you money and pays the attacker.
It often goes unnoticed until the next invoice. Because each number is requested once or twice, limits keyed on the phone number do nothing.
Why it matters to an online business
- Costs can reach thousands of dollars in a day.
- Real users can be delayed or blocked when the provider throttles you.
- Your sender reputation can suffer.
How businesses defend against it
- Limit how many codes one device and one network can request in a window.
- Put a human check in front of the send.
- Restrict the countries you send to.
- Alert on a sudden rise in sends or a drop in the share of codes that are used.
Where FingerPrint Checker fits
FingerPrint Checker adds a usage quota keyed on the device and the network, so changing the phone number does not reset it. Call the quota check before you contact your SMS provider, and send only when it allows. Scripted requests meet a human check on a device’s first use in each window.
It is not a phone-number reputation service and does not judge number ranges or carriers.
Frequently asked questions
Who profits from SMS pumping?
The attacker, or a telecom party they work with, receives part of the termination fee on every message you send to their numbers.
How do I notice it?
Look for spikes in sends to unusual countries and a falling share of codes that users enter correctly.
Does a CAPTCHA stop it?
It slows simple scripts but it does not cap the volume. A per-device quota does.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.