A product manager at a Singapore e-commerce platform opens the monthly SMS invoice and does a double take. The total is several times higher than usual.
She checks the sign up dashboard. New users are flat. No campaign ran and no promotion launched. The delivery report shows nearly every message reached a phone.
Nothing looks broken. Yet thousands of one time passcodes (OTPs) went to numbers that belong to no customer, and every one of them was billed.
This is Artificially Inflated Traffic (AIT), also known as SMS pumping. It hits businesses directly in the wallet, often before anyone notices. Here is how it works, how to spot it early, and how to stop it before it scales.
How AIT Attacks Work
In an AIT attack, bots send large volumes of fake OTP requests to a sign up or login flow, as if they came from real users. Attackers start small, below the radar of normal daily fluctuation, then scale up to staggering volumes.
The cost model is what makes it painful. SMS is charged per submission, so every request is paid to the mobile operator, real or fake. The business absorbs the loss.
Fraudsters profit because the traffic earns money along the route. As Infosecurity Magazine reports, attackers can enter premium rate numbers that generate funds for them and for the mobile operator involved. Sometimes operators are party to the scam, and sometimes they are not.
AIT Fraud by the Numbers
This is not a niche issue. BICS estimates around USD 10 billion was lost to SMS traffic pumping globally in 2021.
It keeps growing. Juniper Research estimates that AIT cost enterprises USD 8.5 billion in 2023 and forecasts USD 23.4 billion by 2027.
Individual brands can be hit much harder. Research from Lanck Telecom, reported by Infosecurity Magazine, found that 30% to 60% of traffic may be artificially generated for some major brands, and up to 80% on some networks.
The Warning Sign Most Teams Miss
Across the AIT cases 8×8 has handled, one pattern repeats: customers don’t monitor their OTP conversion rate. In 8×8’s data, 70% of customers who experienced fraud weren’t tracking it.
In these cases, attacks typically targeted OTP sign ups on the customer’s app or website, and often sent traffic to countries where the customer does not operate.
Delivery rate and conversion rate answer different questions. Delivery rate tells you the SMS reached a phone. Conversion rate tells you whether a human actually entered the code. In an AIT attack, delivery looks healthy while conversion collapses. That gap is your earliest warning sign.
Did You Know? A delivery report only proves a message reached a phone. It cannot show whether a person was on the other end.
Other warning signs of an abused sign up form, as noted by TheSMSWorks in Infosecurity Magazine, include:
- A sharp increase in web traffic and automatically generated SMS messages
- Large text volumes sent to unusual countries
- Texts triggered to batches of numbers in numerical order
- Web forms left partly filled in by bots
Three Things You Can Do Today
- Track OTP conversion rate, not just delivery rate. Set an alert for sudden drops, and check it by country as well as in total.
- Restrict OTP traffic to the countries you actually operate in. Block or disable OTP sends to the rest.
- Set rate limits per phone number and per IP address. Cap how many codes one number or one source can request in a given period.
These controls help, but attacks start small and adapt. That is why continuous monitoring matters.
How 8×8 Omni Shield Detects and Stops AIT
8×8 built Omni Shield to reduce AIT risk, and it has won international awards. It sits on your traffic sent via the 8×8 SMS API and flags suspicious patterns based on past behaviour.
Traffic Anomaly Detector
Watches volume, conversion rate, delivery rate, and operator breakdown for fraud patterns, so a spike hidden in one metric shows up in another.
Phone Number Intelligence
Scores the validity and responsiveness of numbers based on historical behaviour, which helps separate real users from numbers that never respond.
Alerts to You and the 8×8 Support Team
When Omni Shield flags a suspicious pattern, an alert goes to both you and the 8×8 Support Team. The team can temporarily suspend the affected operators or countries.
Review and Decide in 8×8 Connect
You then log in to the dashboard on 8×8 Connect to review the traffic and decide your next step.
The key benefits:
- Stronger security: suspicious patterns are flagged early, before they scale.
- Better conversion: OTP traffic stays focused on real users.
- Lower spend on fraudulent traffic: fewer fake messages reach operators.
- More trust from your customers: sign up and login flows stay reliable.
Read More: SMS Fraud Protection: How 8×8 Omni Shield Keeps You Safe
Read More: Detecting and Blocking Fraud in Shipping Notifications as It Happens
Protect Your SMS Budget Before the Next Invoice
AIT does not announce itself. It starts quietly, looks healthy in the delivery report, and shows up on the invoice. For Singapore businesses running high-volume OTP flows, tracking conversion rate, tightening country and rate limits, and adding continuous monitoring give you a measurable way to catch it early.
Want to see how Omni Shield can protect your business? Explore 8×8 Omni Shield or talk to 8×8.
FAQ: AIT Fraud
- What is AIT in SMS? AIT, or Artificially Inflated Traffic, happens when bots request large volumes of OTP messages through a sign up or login flow, creating SMS charges for traffic that serves no real purpose. It is also called SMS pumping.
- How can I tell if I am being hit by AIT? Look for a sudden jump in SMS volume without a matching rise in real sign ups, traffic to countries where you do not operate, and a falling OTP conversion rate while delivery rate stays high.
- Why does delivery rate look healthy during an attack? Delivery rate measures whether the SMS reached a phone. The fake requests are still sent and delivered, so delivery looks normal. Conversion rate shows whether a person entered the code.
- Who pays for AIT traffic? The business that sends the messages. SMS is charged per submission, so every request is paid to the mobile operator, real or fake.
- How does Omni Shield help? It monitors traffic sent through the 8×8 SMS API with a Traffic Anomaly Detector and Phone Number Intelligence. When it flags a suspicious pattern, it alerts you and the 8×8 Support Team, who can temporarily suspend affected operators or countries.
