AIT attacks drain corporate budgets by triggering millions of OTP messages to revenue-sharing rogue telecom prefixes. Stop them with velocity controls and risk gates.
Artificially Inflated Traffic (AIT), also known as SMS toll fraud, costs businesses hundreds of millions annually. Fraudsters partner with corrupt mobile virtual network operators (MVNOs) or premium rate number brokers, then unleash automated bots on public signup forms to trigger millions of automated SMS verification codes.
1 How Fraudsters Monetize Traffic Pumping
In standard telecommunications interconnect billing, the originating carrier pays termination fees to the destination carrier. Corrupt destination carriers share a fraction of this termination fee (e.g. $0.05 per message) with the fraudster. By triggering 100,000 SMS verification messages overnight, fraudsters net thousands in illicit payouts.
2 High-Risk Geographies and Prefix Filtering
AIT attacks disproportionately target high-termination-rate prefixes (e.g. parts of Eastern Europe, Central Asia, and Africa). Implement strict risk scoring:
- Block signups from high-cost prefixes where your service has no legitimate customer base.
- Enforce Cloudflare Turnstile or CAPTCHA challenges before triggering SMS sends.
- Monitor conversion rates: if a specific country prefix has an OTP conversion rate under 5%, temporarily pause automated messaging to that destination.
Frequently Asked Questions • OTP & 2FA Engineering
Require user email verification before triggering an SMS verification code, or place a Cloudflare Turnstile invisible challenge directly on the phone submission form.
Rarely. Carriers consider traffic delivered once signaling reaches destination switches, meaning standard carrier termination charges remain legally enforceable.