Everything worth knowing, nothing that isn't.
How a pumping attack works
AIT abuses any web or app form that sends an SMS on demand — signup, login, phone verification, "resend code." A fraudster scripts bots to request that SMS thousands or millions of times, targeting phone numbers in ranges they control or that route through a colluding party in the delivery chain (an aggregator or terminating operator taking a revenue share). Each message the brand's provider sends generates a billable termination fee that flows, in part, to the fraudster.
- Entry point: any unauthenticated "send me an SMS" endpoint (OTP, verify, resend).
- Bots generate mass requests to fraudster-controlled or colluding number ranges.
- Revenue-share collusion in the delivery chain converts volume into payout.
- The brand pays; no real user ever receives value.
The fraud economics — why AIT is a business
AIT is a revenue-share fraud. It only works when someone in the termination chain — a rogue aggregator or an operator willing to look the other way — shares the inflated termination fee with the party generating the traffic. High-cost international number ranges are especially attractive because each pumped message carries a larger fee to split. Grey routes are the natural conduit, since sanctioned operator-direct routes are monitored and reconciled.
- Requires collusion in the terminating chain to monetize.
- High-cost destination ranges maximize the fraudster's cut per message.
- Grey routes are the preferred, harder-to-reconcile conduit.
- Industrialized scale — Juniper Research estimated known AIT at ~18% of international A2P SMS in 2023.
What it costs the industry
Estimates vary by scope, so cite carefully. Juniper Research (published March 2024, with VOX Solutions) put the global cost of AIT and SMS trashing to enterprises at roughly USD 8.5 billion in 2023, projecting it to still cost around USD 23.4 billion by 2027. For context, the CFCA Global Fraud Loss Survey 2023 estimated total telecom fraud at about USD 38.95 billion.
- Juniper Research: ~USD 8.5B cost to enterprises in 2023; ~USD 23.4B by 2027.
- CFCA 2023: total telecom fraud ~USD 38.95B.
- Attribute every number to its source and year — scopes differ.
Detection signals — how to tell you are being pumped
AIT leaves a distinctive fingerprint because the traffic is engineered for fees, not users. The clearest tell is a spike in OTP/verification requests that does not convert into signups, logins, or any downstream activity — high send volume, near-zero engagement. Pumped numbers often do not exist on the network, so delivery receipts come back undelivered with absent-subscriber codes. Watching send-to-conversion by destination is often the single most revealing metric.
- OTP request surge with no signup/login conversion.
- Traffic suddenly concentrated in unusual countries or number ranges.
- Automation-shaped time-of-day and burst patterns.
- Low DLR success (absent-subscriber codes) on the pumped ranges.
Sender-side defenses — what the brand controls
Because AIT starts at the brand's own endpoint, the first line of defense is there. Rate-limit and add CAPTCHA or bot-detection to OTP endpoints. Apply geo and velocity controls — block or challenge verification requests to destinations you do not serve. Validate the destination number with HLR Lookup before sending; pumped numbers often fail. Where possible, move high-risk flows to authenticator apps or silent network verification, which remove the pumpable SMS entirely.
- Rate limiting plus CAPTCHA/bot detection on OTP endpoints.
- Geo/velocity limits; block destinations you do not serve.
- HLR pre-validation and number-range blocklists.
- Migrate high-risk flows to flash-call or silent network verification.
Network-side defenses — what the operator and firewall control
On the network side, an SMS firewall and route monitoring catch what the brand misses. The firewall detects abnormal OTP-request concentration and destination anomalies and can throttle or block suspect flows, while route reconciliation exposes the grey routes and high-cost ranges AIT depends on. Operating over sanctioned operator-direct routes rather than grey routes removes the fraudster's preferred conduit and yields accurate, handset-confirmed delivery receipts that make pumping easier to spot.
- Firewall-level anomaly detection on OTP and destination patterns.
- Route reconciliation to surface grey routes and high-cost ranges.
- Operator-direct routing removes the grey-route conduit AIT relies on.
- Accurate DLRs make pumped, never-read traffic visible.
How BroadNet helps
BroadNet's OTP product (/products/myotp) ships with AIT protection on by default: per-MSISDN, per-IP and per-device rate limiting; HLR pre-validation; auto-block of MCC/MNC ranges with no historical delivery success in your account; and an AIT-detection model trained on cross-customer attack patterns. Combined with operator-direct routing, it narrows the space in which pumped traffic can hide and be monetized.
- Rate limiting per MSISDN, IP and device by default.
- HLR pre-validation + auto-block of no-delivery ranges.
- AIT-detection model on cross-customer patterns.
- Operator-direct routing + honest DLRs to expose pumped traffic.
AIT defenses: sender-side vs. network-side
| Sender-side (the brand) | Network-side (operator / firewall) | |
|---|---|---|
| Rate limiting + CAPTCHA on OTP endpoints | — | |
| Geo/velocity + number-range blocklists | ||
| HLR pre-validation before send | — | |
| Firewall anomaly detection + throttling | — | |
| Operator-direct routing + honest DLRs | — | |
| Move flow off SMS (authenticator / silent verify) | — |