Key takeaways
- Fraudsters trigger code messages to numbers that earn them a share of the delivery fees.
- The warning sign is a jump in code requests with few codes actually entered.
- The defence is in your own forms: rate limits, country rules, bot checks and spend alerts.
- Monitor the share of codes that are used, by country and number range.
How the scheme works
An attacker finds a form that sends a text message, such as sign-up, login or password reset, and sends it to a large number of numbers, often in a few countries and from a number range the attacker has an interest in. Parts of the delivery fee can end up with the party that controls those numbers.
The messages are delivered, so they are billed. The traffic is real in the system but has no customer behind it.
Signs to look for
- A sudden rise in code requests, often at night or in bursts
- Requests to countries or number ranges where you have few or no customers
- A very low share of codes that are actually entered
- Many requests from one IP address, device or small set of accounts
- Sequences of numbers that look generated
Controls that work
- Rate limits per IP address, device, account and phone number
- A list of countries you serve, with extra checks or a block for the rest
- A bot check or another challenge before a code is sent
- Email or account verification before SMS is offered
- Monitoring of conversion (codes requested versus codes entered) by country and prefix
- Spend alerts and a daily cap that pauses sending when it is reached
If it is happening now
- Tighten rate limits and country rules at once
- Turn on or add a bot check on the form
- Pause sending to the affected countries or ranges
- Tell your provider, who can look at the traffic on its side
- Keep the logs for the review and for any billing discussion
Questions to ask a provider
- What traffic monitoring, spend limits and country controls do you offer?
- How are you notified about unusual spikes?
- How does the agreement treat traffic that turns out to be fraudulent?
How ZafeConnect fits
ZafeConnect charges for delivered messages, so artificially generated traffic that is delivered is billed like any other. That makes controls in your own forms important, and it is worth agreeing in advance how suspected fraudulent traffic is handled. Talk to us about the monitoring and limits that apply to your account.