Detect the scripts that trigger paid SMS verification codes
Bots request SMS verification codes in bulk from your sign-up and login forms, sent to phone numbers the fraudster controls. You pay for every message, and a colluding carrier shares that fee with the fraudster.
Request a site auditEvery code request is a paid message
A send-code route turns one request into one paid message. SMS pumping scripts submit that request with phone numbers the fraudster controls, on a carrier that shares the fee, and the code is never entered. A limit per phone number does not stop the attack, because each request uses a different number.
Read the analysisWhat the traffic looks like
A fresh number on every request
The script walks a block of adjacent numbers on the same operator, so no single number repeats often enough to trip a per-number limit.
Codes that are never entered
The attacker wants the message, not the account. Completed verifications stay flat while sends climb, often to countries where the site has few users.
Every route that sends a message
Sign-up, login, password reset, and resend buttons can all trigger an SMS. The script uses whichever one has the weakest check.
What runs against this traffic
Evidence before the code is sent
In supported browser flows, Centinel evaluates browser and request evidence on the request that asks for a code, whatever phone number it carries.
A scripted send request can be challenged or blocked before your SMS provider sends and bills the message.
Read more: Evidence before the code is sentA bounded policy for send and resend routes
Where the integration supports it, a policy can observe, rate-limit, challenge, or block code-request routes separately from the page around them.
Teams can tighten the send route during an attack without adding friction to the rest of sign-up or login.
Read more: A bounded policy for send and resend routesKeep the SMS provider's controls
Centinel does not evaluate destination numbers, carriers, or countries, and does not replace SMS provider fraud controls or geographic permissions.
The provider keeps judging the destination while Centinel adds evidence about how the request was made.
Read more: Keep the SMS provider's controls
See what reaches your site
Start with a free scraping audit. A person reviews the scraping test results, then emails you the exposed pages and fixes to consider. The audit covers scraping exposure only, not every abuse pattern or all production traffic. Discuss broader coverage in a demo.