To commit SMS pumping, fraudsters actively use bots and automated scripts that generate a massive amount of requests effortlessly. Thus, attackers generate revenue for a partner telecom company and share this income afterward.

How to recognize SMS pumping fraud

The main sign of an SMS pumping attack is receiving a high volume of requests for SMS authentication per applicant, specifically more than three SMS requests per profile.

The main type of SMS messages used in these attacks is OTP requests triggered during the Phone verification step.

Modify verification scenarios to prevent SMS pumping fraud

By default, Sumsub creates an additional layer of security by reducing the number of allowed SMS to 5 per telephone number. However, to strengthen your verification flows further, you can take the extra measures described in the following workflow setup:

1. Navigate to Workflow builder.
2. Select ID + Liveness as your first verification step.
3. Add the condition as shown below.
4. Add the Reject and Phone verification steps.
5. Publish your workflow.

Now, the applicants will only be able to proceed with phone verification after their identities are confirmed.