Protecting Small Business from SMS Pumping Fraud

What is SMS pumping fraud?

SMS pumping fraud occurs when scammers attempt to make money by ambushing online forms that generate automated one time password (OTP) texts. SMS pumping fraud occurs with the repeated sending of SMS (text) messages to mobile numbers controlled by the scammers. With these cell phone numbers, often obtained from marketing lists and other sources, fraudsters use automated software to send thousands of messages in a matter of minutes. The SMS messages usually contain a call to action, enticing the recipient to reply to the message or click on a link. Each reply or click generates a small fee for the fraudsters, which can add up over time as the messages continue to be sent. With inadequate protections on the web form, hackers can perpetrate this fraud on an industrial scale. This inflated SMS traffic is sometimes referred to as artificially generated traffic (AGT).

What are the consequences for a business that falls victim to SMS pumping fraud?

For businesses affected by SMS pumping fraud, the consequences can be severe. Charges can add up quickly, and in some cases, the bills can amount to thousands of dollars. In addition to the financial cost, there is also the risk of reputational damage if customers are inundated with unwanted SMS messages or if they feel that their privacy has been violated.

What are some signs SMS pumping fraud has taken place?

• A sudden and large increase in web traffic and auto-generated SMS. Unfortunately, this does not necessarily mean your service has just become extremely popular. When you compare this volume to normal message traffic, you can get an indication if you have been attacked.
• Significant numbers of texts being sent to numbers in different countries. If messages are being sent to places you do not have customers, it is likely artificially generated traffic.
• Phone numbers receiving texts are in numerical order. Automated software often triggers texts to batches in numerical order. Review an SMS delivery reports to determine if this is taking place.
• Partially completed web forms. When a bot is involved in this fraud, a web form may be completed with garbage or only partially completed. An extreme number of responses with information missing is a good indication that SMS pumping fraud has occurred.

What should you do if you suspect SMS pumping fraud?

If you suspect that your business has fallen victim to SMS pumping fraud, act quickly. Contact your telecom provider to report the issue and dispute any fraudulent charges. You should also take steps to identify the source of the fraud and inform the relevant authorities, if necessary.

How can a small business owner protect themselves from SMS pumping fraud?

The most effective way to protect your business from SMS pumping fraud is to be proactive. There are some steps you can take:

• Use a 2FA solution that does not rely on SMS. There are a number of 2FA solutions available that do not use SMS, such as those that use push notifications or hardware tokens.
• Monitor your SMS traffic for unusual spikes. If you see a sudden increase in the number of SMS messages that you are sending, it could be a sign of SMS pumping fraud.
• Use a fraud detection service. There are a number of fraud detection services available that can help you identify and prevent SMS pumping fraud. You should also use a firewall and antivirus software. This will help to protect your business’s computer systems from malware and other threats.
• Educate your stakeholders about SMS pumping fraud. Make sure that your employees are aware of the risks of SMS pumping fraud and how to spot it.

What can employees of a business do to minimize risk of SMS pumping fraud?

• Keep your software up to date. Mobile carriers and software providers often release security updates that can help to protect your business from fraud.
• Use a dedicated business phone number. This will help to prevent fraudsters from using your personal phone number to send spam or phishing messages.
• Be careful about what information you share online. Do not share the business number assigned to you or other sensitive information on public websites or social media.
• Be suspicious of any unsolicited messages. If you receive an SMS message from someone you do not know, be careful about clicking on any links or responding to any requests.

Keeping your business safe from SMS pumping fraud requires ongoing vigilance and proactive measures. By implementing a few safety measures and educating your employees, you can reduce the risk of falling victim to this type of fraud. Remember, prevention is always better than cure.