SMS toll fraud, also known as SMS pumping, can create unexpected SMS activity and costs when automated bots submit phone numbers through a public Signup Form.
This article explains what SMS fraud is, how it can happen, and how to reduce the risk in Omnisend.
What Is SMS Toll Fraud?
SMS toll fraud is a type of fraud in which attackers generate large volumes of SMS messages to make money from the resulting messaging traffic.
Attackers typically use automated bots to repeatedly submit phone numbers through websites or forms that trigger SMS messages. This generates artificial messaging traffic, which can result in unexpected costs for the business.
💡 SMS toll fraud is also known as SMS pumping fraud and is a common form of Artificially Inflated Traffic (AIT), which refers to fraud that artificially increases telecom traffic.
How SMS Toll Can Happen
For example, imagine your store has an Omnisend Signup Form that collects phone numbers and triggers a welcome SMS through an Automation Workflow.
An attacker could exploit this setup by:
Using an automated bot to repeatedly submit phone numbers through your Signup Form.
Triggering SMS messages from the connected Automation Workflow.
Causing SMS messages to be sent to the submitted phone numbers.
As a result, your store may experience unusually high SMS activity and unexpected SMS credit usage, even though the submissions don't represent genuine customer interest.
Important: SMS toll fraud can exploit a legitimate, publicly accessible Signup Form or Automation Workflow. It doesn't necessarily mean someone has accessed your Omnisend account or obtained your login credentials.
How SMS Toll Fraud Can Affect Your Store
SMS toll fraud may result in:
An unexpected increase in Signup Form submissions.
An unusually high number of new SMS subscribers in a short period.
Contacts or traffic from countries you don't normally target.
An unexpected increase in SMS sending.
SMS credits being used faster than expected.
These signs don't necessarily mean SMS pumping is occurring. Unusual activity may have other causes, and not every contact from a high-risk country is fraudulent.
How Omnisend Helps Reduce the Risk
Omnisend turns off SMS sending by default for certain countries where there is a higher risk of fraudulent or automated traffic. This helps reduce the risk of unexpected SMS activity and costs.
When SMS sending is disabled for a country:
SMS messages cannot be sent to phone numbers from that country.
Visitors cannot select that country when subscribing to SMS through your Omnisend Signup Forms.
You can manually enable SMS sending if your business needs to reach customers in that country.
The list of high-risk countries may change as fraud patterns evolve. A high-risk classification doesn't mean every phone number or business in that country is fraudulent.
If you need to review, enable, or disable SMS sending for a country, see Manage SMS Sending for High-Risk Countries.
How to Reduce the Risk of SMS Toll Fraud
You can take several steps to help protect your store:
Keep unnecessary countries disabled. Only enable SMS sending for countries where you need to reach customers.
Review Signup Form activity. Watch for unexpected increases in submissions or unusual signup patterns.
Check where your contacts come from. Make sure the volume and geographic distribution of new SMS subscribers align with your business activity.
Monitor SMS usage. Pay attention to unexpected increases in SMS sending or unusually fast SMS credit consumption.
Enable reCAPTCHA on Signup Forms. Use reCAPTCHA to help reduce automated submissions, especially on forms that collect phone numbers.
💬 Learn more: Set Up Google reCAPTCHA for Your Signup Forms.
FAQ
Is SMS toll fraud the same as SMS pumping?
Yes. SMS toll fraud and SMS pumping refer to the same type of fraud, in which attackers artificially generate SMS traffic for financial gain. Both terms are commonly used in the telecommunications industry.
Does a high-risk country mean that every phone number there is fraudulent?
No. The classification indicates a higher risk of fraudulent or automated traffic. It does not mean that every contact or business in that country is fraudulent.
Why did Omnisend turn off SMS sending to a country?
Omnisend turns off SMS sending by default for certain countries where there is a higher risk of SMS pumping or other automated traffic. This helps reduce unexpected SMS activity and costs.
Can I enable SMS sending to a high-risk country?
Yes. You can still enable a high-risk country if you serve customers there. Before enabling SMS sending, review your recent signup activity and follow the instructions in Manage SMS Sending for High-Risk Countries.
Does reCAPTCHA completely prevent SMS pumping?
No. reCAPTCHA can reduce automated Signup Form submissions, but it does not guarantee that all fraudulent activity will stop.
Can the list of high-risk countries change?
Yes. Omnisend may change the list as fraud patterns change.
Need further guidance? Our Support Team is available 24/7. Contact us through in-app chat or at [email protected].