SMS fraud: a per-device quota before you send

The threat

Public endpoints that send a message are abused to run up your bill or to harass people. Limits keyed on the destination number fail, because the attacker simply changes the number.

What we stop

• One device requesting many verification messages inside a window, whatever number it types.
• Many requests from one network.
• Scripted requests, which meet a human check on a device’s first use in each window.

How it works

Identify the device in the page that asks for the message, send the attestation to your backend, and call the quota check before you contact your SMS provider. You choose the quota name; the allowance per visitor, per network and the window are set per project. If your own sending fails afterwards, release the use so the visitor is not charged an attempt.

This is a quota, not a phone-number reputation service: it does not judge number ranges or carriers.

Your project handles the trial kind out of the box. Further claim kinds, such as a coupon or a sign-up bonus, and named quotas are switched on for your project on request.

Check the quota before sending

const q = await (await fetch('https://api.fpchecker.com/v1/quota', {
  method: 'POST',
  headers: { 'content-type': 'application/json', 'X-Secret-Key': process.env.FPCHECKER_SECRET_KEY },
  body: JSON.stringify({ attestation, quota: 'sms_otp', consume: true, idempotencyKey, clientIp }),
})).json();

if (q.allowed === true) { /* send the SMS */ }
else { /* refuse; q.retryAt says when a use frees up */ }

Frequently asked questions