Everything worth knowing, nothing that isn't.
How the fraud works
A bot hammers a signup, login, or 'resend code' form, requesting OTPs to numbers on a route where the fraudster and a complicit party share the operator termination revenue. The messages deliver perfectly — that is the point — so the only visible symptom is a sudden spike in OTP volume and cost to a handful of destinations. See /answers/what-is-sms-pumping.
How to defend against it
Layered controls: validate numbers with HLR Lookup before sending, rate-limit OTP requests per IP and per number, apply geo-velocity and destination-anomaly checks, add CAPTCHA on abused forms, and fail over to Flash Call where SMS is being pumped. Monitor OTP conversion by country so a bad route stands out. See /products/hlr-lookup and /products/myotp.