The escalating threat of AIT in modern telecommunications

When digitalisation presents both opportunities and challenges

SMS remains one of the most popular and effective channels for businesses to stay engaged with their consumer base, whether it’s for marketing, customer service, or security purposes. But its immense global popularity has also made it a prime target for exploitation by cyber criminals and other rogue parties.

SMS pumping occurs when fraudsters trigger high volumes of text messages to be sent from unprotected SMS systems. They usually target automated channels like OTP requests, and then profit off the messages sent. Common marks include banking, e-commerce, social media, and ride-hailing apps, but any business can be vulnerable to SMS pumping.

Amongst the top threats of SMS messaging is Artificially Inflated Traffic (AIT), also known as SMS Traffic Pumping Fraud. Traffic pumping was the second-most common telecom fraud reported in 2021.

How does SMS pumping work?

Target Identification

Malicious actors identify vulnerable SMS systems, often those using automated channels like OTP requests.

SMS Volume Increases

They flood these systems with a large number of message requests, overwhelming the system.

Profit Generation

By exploiting premium-rate numbers or receiving kickbacks, fraudsters profit from the increased SMS traffic.

Businesses Get Impacted

This fraudulent activity often leads to financial losses, damage to reputation, and operational disruptions for affected businesses.

How does SMS pumping work?

To catch SMS pumping before it escalates, watch out for some of the following symptoms:

Sudden spikes in incoming message volume, especially if received during off-peak hours of your main target market, or from regions or countries that you don’t normally get traffic from
Unexpected increases in SMS bills, especially if you have no currently running marketing or promotional campaigns
Sequential number patterns in the phone numbers sending you message requests, especially if clustered around the same timing
A discrepancy between engagement metrics and actual conversions, suggesting inflated engagement from fake or non-genuine sources
Complaints from genuine customers about difficulties reaching you due to network congestion