Detect the scripts that trigger paid SMS verification codes
Every verification code a site sends by SMS costs money. SMS pumping scripts request codes in bulk to numbers that earn the fraudster a share of that cost. Centinel evaluates the request that asks for the code, before the message is sent.
Request a site auditThe phone number field is a spending button
A send-code route turns one request into one paid message. SMS pumping scripts submit that request with numbers controlled by a mobile operator that shares the revenue, and nobody ever enters the code. A limit on the phone number misses the attack, because each request uses a different number.
Read the researchWhat the traffic looks like
A fresh number on every request
The script walks a block of adjacent numbers on the same operator, so no single number repeats often enough to trip a per-number limit.
Codes that are never entered
The goal is the message, not the account. Verification completions stay flat while sends climb, often toward countries the site has few users in.
Every route that sends a message
Sign-up, login, password reset, and resend buttons can all trigger an SMS. The script uses whichever one has the weakest check.
What runs against this traffic
Evidence before the code is sent
In supported browser flows, Centinel evaluates browser and request evidence on the request that asks for a code, not only the phone number submitted.
A scripted send request can be challenged or blocked before your SMS provider sends and bills the message.
Read moreA bounded policy for send and resend routes
Where the integration supports it, code-request routes can be observed, rate-limited, challenged, or blocked separately from the page around them.
Teams can tighten the send route during an attack without adding friction to the rest of sign-up or login.
Read moreKeep the SMS provider's controls
Centinel does not evaluate destination numbers, carriers, or countries, and does not replace SMS provider fraud controls or geographic permissions.
The provider keeps judging the destination while Centinel adds evidence about how the request was made.
Read more
Want to see what reaches your site?
Start with a free scraping audit: tested tools, exposed pages, and fixes to consider, reviewed by hand and emailed to you. This checks scraping exposure, not every abuse pattern or all production traffic. Discuss broader workflow coverage in a demo.