# SMS pumping (artificially inflated traffic)

SMS pumping is fraud in which bots make a business send texts, usually one-time codes, to numbers where someone is paid a share of each message's delivery fee.

Date: 2026-09-27

SMS pumping, also called artificially inflated traffic (AIT), is fraud in which automated requests make a business send text messages, usually one-time codes from a signup or login form, to numbers where someone is paid a share of the fee for delivering each message. The business pays for every message, nobody enters a code, and each destination number looks ordinary on its own.

## How it differs from IRSF and wangiri

The three schemes all live on a share of what a network charges to reach a number, and they are easily confused:

| Scheme | What is abused | Who pays | What a Spaw lookup can see |
| --- | --- | --- | --- |
| SMS pumping (AIT) | A business's own SMS sending, triggered through its forms or API | The business, per message | The destination's country, line type and range, and the account's own lookup pattern |
| International revenue share fraud (IRSF) | Calls, and sometimes messages, pushed to premium-rate or international numbers whose termination fee is shared, often through a hijacked phone system | The operator or business whose line placed them | `premium_rate`, `international_network` and the country |
| Wangiri | One-ring missed calls from a premium-rate or international number, hoping the person rings back | The person who calls back | Nothing about the call: Spaw sees no calls. A lookup of the number that rang shows only its line type and country |

## What Spaw's signals flag

Every lookup applies the account's [SMS policy](/glossary/sms-policy) and answers `ok_to_send`, with `blocked_by` naming the rule that decided. The parts that bear on pumping:

- **Countries.** An allow-list of the countries you send to is the first control. A number's country is its own: libphonenumber 9.0.37 files 25 regions under +1, 23 of them outside the US and Canada, so under `allowed_countries: ["US", "CA"]` a +1 876 (Jamaica) or +1 787 (Puerto Rico) number answers `blocked_by: "country"`. A number with no country, such as one under +800, +870, +881, +882 or +883, is outside every allow-list.
- **Line type and network.** [`premium_rate`](/docs/signals/phone/premium_rate) (+60) is blocked by default. [`international_network`](/docs/signals/phone/international_network) (+30) is not: +882 34 2 1234, which the plan types as mobile, scores 30; +882 16 123456 and +883 510012345, typed as VoIP, score 60 (voip + international_network); both pass the default ceiling, which blocks only a score above 60. Name the signal in `block_signals`, or set an allow-list, to refuse them.
- **Your own traffic.** [`range_burst`](/docs/signals/phone/range_burst) (+40) fires when your account looked up five or more distinct numbers in one 1,000-number range within 60 minutes; [`numbers_per_client`](/docs/signals/phone/numbers_per_client) (+30) when one client address you sent as `client_ip` tried five or more numbers in the same window. Under the defaults `range_burst` alone passes, and the two together (70) answer `blocked_by: "risk_score"`. `destination_new_for_you` is true when your account has not looked up a valid number in that country in the last 30 days; it carries no weight.
- **Alerts.** The account owner is emailed on a range burst, on a destination spike (an hour with at least 20 lookups to one country and ten times its hourly average over the previous 14 days) and on enumeration (an hour with at least 50 lookups to one country, half or more of them invalid or in blocks nobody holds).
- **Outcomes.** Report `delivered` and `verified` to the phone feedback endpoint and the summary's `verified_share` falls when codes are delivered and never entered.

## What they cannot see

Spaw sees lookups, not messages. It cannot tell whether you sent a text, what it cost, or who was paid for it.

A pumped number in a country you serve can be an ordinary mobile number, and a single lookup of it scores nothing. Your allow-list does not stop it; what stands in the way is the pattern of your own lookups and your own outcome reports, and each has limits. The own-traffic fields count single and browser lookups only: batch, bulk and monitor runs, the test numbers and the guest demo are never counted, and no other account's lookups are read. `numbers_per_client` does not fire for an address on a mobile carrier or a corporate proxy, where many people share one address, and it does not catch an attack rotated through residential proxies. `destination_new_for_you` and the spike alert stay silent until a week of the account's own lookups has been counted.

An allow-list is a business choice about where you send, not a verdict that a country's numbers are fraudulent, and Spaw publishes no list of risky countries or pumping figures of its own. Each country's calling code, and the line types its plan uses, is under [phone facts by country](/tools/phone-number-lookup/countries). The guide [SMS pumping: what the default SMS policy lets through](/guides/sms-pumping-what-the-default-sms-policy-lets-through) walks through the destinations the defaults pass and the one policy request that adds a country list and the `range_burst`, `numbers_per_client` and `international_network` signals.

Reference: https://spaw.co/glossary/sms-pumping