2P SMS fraud in 2026 comes from both ends of the message. On the enterprise side, SMS pumping (Artificially Inflated Traffic) turns your own verification flows into a billing attack. On the operator side, grey routes and signalling exploits siphon revenue and degrade delivery. The defence is layered: rate limiting and monitoring for the traffic you send, and an operator-grade SMS firewall plus direct A2P routes for the traffic that crosses the network.
SMS pumping: the fraud that abuses your own OTP flow
SMS pumping, also called Artificially Inflated Traffic (AIT), is when fraudsters use bots to trigger huge volumes of one-time-passcode sends to a range of numbers they control or profit from, earning a share of the termination revenue while you pay for every message. Because the traffic flows through your legitimate signup or login forms, it hides inside normal patterns until the bill spikes. See what is sms pumping and what is ait.
- Rate-limit OTP requests per phone number, per IP, and per session so no single actor can trigger a flood.
- Add velocity and anomaly checks that flag sudden spikes to unusual country codes or number ranges.
- Use CAPTCHA or device attestation on high-risk forms to keep bots out of the send path.
- Cap or step-up verification for destinations you do not normally serve.
- Consider network-based verification (silent network authentication) that does not send a billable code at all.
The cheapest OTP is the one you never had to send. Pairing rate limits with silent network authentication and a fallback to SMS removes most of the pumping attack surface while keeping conversion high.
Grey routes: fraud against the operator and your deliverability
A grey route is A2P traffic disguised as consumer P2P to dodge the operator's A2P agreement — through SIM boxes, foreign HLR backdoors, or undeclared interconnects. It defrauds the operator of A2P revenue and degrades the sender's delivery, because firewalls detect and block the route, your sender ID collapses to a raw number, and delivery oscillates. See what is grey route sms.
For enterprises, the defence is simple to state and harder to enforce: send only over direct A2P routes, and measure cost per delivered message rather than headline rate so a cheap grey route cannot tempt you into unreliable delivery. See sms deliverability economics 2026 and how to choose sms provider.
The operator firewall: defence at the network edge
On the network side, an SMS firewall deployed inside the operator inspects, classifies, and selectively blocks traffic — stopping grey-route A2P, filtering smishing and spoofed sender IDs, and enforcing sender-ID and content rules. It is how operators recover leaked A2P revenue and protect subscribers at the same time. See what is sms firewall and what is a2p monetization.
| Threat | Who it hurts | Primary defence |
|---|---|---|
| SMS pumping (AIT) | Enterprise sender | Rate limits, anomaly checks, network verification |
| Grey routes | Operator + sender | Direct A2P routes, SMS firewall |
| Sender-ID spoofing / smishing | Subscriber + brand | Sender-ID registration, firewall filtering |
| Signalling attacks (SS7) | Operator + subscriber | Signalling firewall (GSMA FS.11) |
Signalling fraud: the layer beneath the message
Beneath SMS sits the signalling network, where SS7 and Diameter exploits enable location tracking, interception, and fraud. A signalling firewall aligned to GSMA FS.11 categories screens this layer, closing the backdoors that grey routes and interception rely on. See ss7 signaling security and gsma fs07 fs11 signaling firewall.
BroadNet operates SMS and SS7 firewalls inside carrier networks and runs enterprise A2P over direct operator routes — so the same posture that protects operators from grey-route and signalling fraud is what makes enterprise delivery reliable. See /operators and telecom fraud prevention.
Frequently asked questions
What is SMS pumping and how do I stop it?
SMS pumping, or Artificially Inflated Traffic, is fraud where bots trigger mass OTP sends to inflate traffic the fraudster profits from while you pay. Stop it with per-number and per-IP rate limiting, anomaly detection on sudden spikes to unusual destinations, bot defences like CAPTCHA on high-risk forms, and network-based verification that avoids sending a billable code where possible.
How do grey routes enable fraud?
Grey routes disguise A2P traffic as consumer P2P to bypass the operator's paid A2P route, defrauding the operator of revenue. They also harm senders: operator firewalls detect and block them, sender IDs degrade, and delivery becomes unreliable. Sending only over direct A2P routes removes both the fraud and the deliverability risk.
What does an SMS firewall protect against?
An operator SMS firewall inspects and classifies inbound SMS to block grey-route A2P traffic, filter smishing and spoofed sender IDs, and enforce sender-ID and content policy. It protects subscribers from fraud while helping the operator recover A2P revenue that grey routes would otherwise leak.
Is SS7 signalling still a fraud risk in 2026?
Yes. SS7 and Diameter signalling exploits can enable location tracking, message interception, and fraud where networks are unprotected. A signalling firewall aligned to GSMA FS.11 screens this layer and closes the backdoors that interception and grey routing depend on, which is why signalling security sits alongside the SMS firewall in a complete defence.
References
- GSMA — FS.11 SS7 Interconnect Security Monitoring Guidelines: gsma.com
- Mobile Ecosystem Forum (MEF) — SMS ecosystem integrity and AIT guidance: mobileecosystemforum.com
- BroadNet — Answers: what is SMS pumping, what is an SMS firewall, SS7 signalling security.