Skip to content
Use case

Detect the scripts that trigger paid SMS verification codes

Every verification code a site sends by SMS costs money. SMS pumping scripts request codes in bulk to numbers that earn the fraudster a share of that cost. Centinel evaluates the request that asks for the code, before the message is sent.

Request a site audit
Why it matters

The phone number field is a spending button

A send-code route turns one request into one paid message. SMS pumping scripts submit that request with numbers controlled by a mobile operator that shares the revenue, and nobody ever enters the code. A limit on the phone number misses the attack, because each request uses a different number.

Read the research
How it works against you

What the traffic looks like

  • A fresh number on every request

    The script walks a block of adjacent numbers on the same operator, so no single number repeats often enough to trip a per-number limit.

  • Codes that are never entered

    The goal is the message, not the account. Verification completions stay flat while sends climb, often toward countries the site has few users in.

  • Every route that sends a message

    Sign-up, login, password reset, and resend buttons can all trigger an SMS. The script uses whichever one has the weakest check.

How Centinel closes it

What runs against this traffic

  • Evidence before the code is sent

    In supported browser flows, Centinel evaluates browser and request evidence on the request that asks for a code, not only the phone number submitted.

    A scripted send request can be challenged or blocked before your SMS provider sends and bills the message.

    Read more
  • A bounded policy for send and resend routes

    Where the integration supports it, code-request routes can be observed, rate-limited, challenged, or blocked separately from the page around them.

    Teams can tighten the send route during an attack without adding friction to the rest of sign-up or login.

    Read more
  • Keep the SMS provider's controls

    Centinel does not evaluate destination numbers, carriers, or countries, and does not replace SMS provider fraud controls or geographic permissions.

    The provider keeps judging the destination while Centinel adds evidence about how the request was made.

    Read more
Start with your site

Want to see what reaches your site?

Start with a free scraping audit: tested tools, exposed pages, and fixes to consider, reviewed by hand and emailed to you. This checks scraping exposure, not every abuse pattern or all production traffic. Discuss broader workflow coverage in a demo.