The 40,000 SMS codes
Your phone sign-in sends a code by SMS. Overnight it sent 40,000 codes to numbers in countries you do not serve.
This answers: What is SMS pumping fraud? No coding needed. 2 quick decisions.
- Costs and abuse
- Who is signed in
Checking your access…
What is SMS pumping fraud?
SMS pumping is when attackers trigger thousands of verification texts to number ranges whose carriers share the fees with them, using your sign-in or invite endpoint and your SMS bill. Prevent it with per number and IP address, allowing only countries you serve, bot checks before sending, and alerts on unusual volume.
Breaks at Your server: No limits on paid sends
How it works
| Day | People | Bots |
|---|---|---|
| Mon | 180 | 260 |
| Tue | 210 | 300 |
| Wed | 160 | 9400 |
| Thu | 190 | 12100 |
| Fri | 230 | 14800 |
| Sat | 120 | 13300 |
| Sun | 110 | 11900 |
Why AI tools write this bug
Phone sign-in templates send a code to any number on request, with no limits, because limits are not needed in a demo.
How to fix it
- SMS per phone number and per IP.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Does a monthly SMS budget stop this?
- It caps the loss, but also blocks real users once attackers spend it.