Some phone numbers pay their owner every time you text them. Send an OTP to one and you've just bought the attacker a cut of the carrier's termination fee. The good news: you can see it coming from the shape of the number alone, for free, before a single byte leaves your server.
How a text bills you
When a message crosses networks, the receiving carrier charges a termination fee to deliver it. For ordinary mobile numbers that fee is trivial. For certain ranges it isn't — the carrier keeps a fat margin and shares part of it back with whoever controls the number range. That's revenue share.
An attacker registers or rents numbers in one of those lucrative ranges, then drives your signup flow to send OTPs to them. Every send is billable termination, and they collect on the other end. This is SMS pumping, and the send is the attack — no click, no reply, no fraud after delivery. The delivery is the fraud.
Why certain international ranges
The most profitable ranges tend to be international, in markets where termination rates are high and revenue-share arrangements are easy to set up. An attacker doesn't need your users. They need your sender to keep dialing numbers that pay them, and a signup form that fires an SMS per attempt is a perfect pump.
It's a property of the destination
Here's the leverage: whether a number bills you is a fact about the destination, knowable before you send. You don't need history, reputation, or a machine-learning verdict. The number's country code and prefix already say what kind of range it is.
Malformed, impossible, and invalid numbers are the same story — they can't be a real user, so any send to them is waste at best and probing at worst.
Rejecting it for free
That's why the first decision layer is destination shape: free, stateless, no Redis, no counters. It parses the number and rejects anything malformed, impossible, invalid, or sitting in a premium-rate range that bills the sender.
Cheapest check, run first, first rejection wins. A number rejected here never touches velocity, never touches reputation, never touches quota. It costs a parse.
Most fraud is more complex than this and needs the later layers. But the premium-range send is the purest form of the attack, and it's also the one you can kill for nothing. Stop the free bleed first, then spend real work on the traffic that actually looks like a user.