SMS pumping is hard to catch one request at a time, because each request looks fine. An OTP to an unfamiliar number is exactly what a real signup from a new market looks like. The attack only becomes visible in the aggregate — and by the time it shows up on the invoice, you've already paid for it.
The tells are in the shape, not the request
Artificially inflated traffic (AIT) is an attacker driving verification sends to premium number ranges they profit from, leaving you the bill. It hides inside traffic that reads as normal.
Three signals give it away when you look at the shape of the flow instead of the single message:
- A spike of sends to ranges or countries you rarely touch. Your baseline is your product's real geography. A sudden column of traffic to number ranges outside it is the loudest early tell.
- Sends and confirmations diverging. Codes go out; nobody enters them. That gap is the signature of automated sends with no human on the other end.
- Geographic anomalies — volume that doesn't match where your users actually are, arriving faster than organic growth ever does.
Confirmation rate is the honest signal
Of those, the confirmation rate is the one an attacker can't fake.
POST /v1/confirm reports that a code was actually entered. Real users type the code in to finish signing up. Fraud farms drive the send — that's where their payout is — and never complete the loop.
So a network's ratio of confirmations to sends is the ground truth of whether it's real traffic or a pump. It's a lagging signal — confirmations trail sends — which is why it's honest: it reflects what humans actually did, not what a request claimed.
Feed it back, and a network that sends constantly but confirms rarely earns a reputation that gets it blocked at the cheapest layer.
Pre-send beats post-hoc
The expensive way to find AIT is the monthly bill review — reconciling spend after the messages are gone and the money with them. At that point detection is just accounting.
The cheap way is to decide before the send. Your backend makes one call to POST /v1/check right before handing the OTP to your provider. Verifence answers allow or deny in single-digit milliseconds.
A deny is a message you never dispatch and never pay for. The aggregate signals — send spikes, the confirmation gap, geographic drift — are already folded into that decision, so the anomaly you'd otherwise spot on the invoice gets stopped at the one moment it's still free to stop: the instant before the message leaves.