How to Stop OTP and SMS Fraud with Phone Risk Scoring

SMS one-time passwords are everywhere, and so is the fraud that targets them. Two problems dominate: SMS pumping (also called toll or traffic-pumping fraud), where attackers trigger huge volumes of OTP sends to premium-rate numbers they profit from, and OTP-based fake-account creation, where disposable numbers absorb codes to mint verified accounts. Both are cheaper to prevent before the send than to clean up after.

The two OTP attacks you actually face

• SMS pumping: bots submit numbers in ranges the attacker controls, forcing you to pay for thousands of international SMS while they collect a cut of the termination fees.
• OTP farming: fraudsters feed disposable VoIP or prepaid numbers through your verification to create verified fake accounts at scale.

Score the number before you send the code

The key insight: the most effective control happens *before* the SMS is sent. If you score the phone number at the moment it's submitted, you can refuse to send codes to high-risk numbers entirely, cutting off both the toll-fraud payout and the fake-account pipeline without spending a cent on the message.

• Line type & VoIP: VoIP and certain prefix types dominate OTP abuse.
• Prepaid: cheap, anonymous, and disproportionately used in farming.
• Carrier & region: sudden spikes to unusual carriers or countries signal pumping.

const r = await fetch("https://api.riskunified.com/phone_risk", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ phone }),
}).then((x) => x.json());

if (r.risk.level === "high" || r.phone_features.voip) {
  // don't send the SMS, challenge with email or an authenticator instead
}

Layered defense

Phone scoring pairs naturally with rate limits and velocity checks. Scoring stops the obviously risky numbers; velocity limits catch distributed attacks that stay under the per-number radar. Together they keep your SMS bill sane and your account base real.