SMS fraud through your code form: how credits get burnt and how to stop it

Security·· 18 views· 3 min read

The short answer: to an abuser, a form that sends SMS codes is a button that spends your credits. Bots type numbers in sequence and press “Send code” thousands of times; every request is an SMS you pay for. The defence comes in layers: brakes on your form (captcha, limits per IP and per session), the account rules in the verification API, and an eye on your balance.

How it happens

Sign What it usually is
Lots of codes requested and almost none checked A bot firing the form; nobody is reading the SMS
Numbers in sequence or with the same start A generated list, not real customers
Many requests from the same IP or session A program, not a person
Requests at odd hours, in volumes you have never had An attack, not one of your campaigns
The SMS balance dropping fast with no new sales Credits being burnt

The layers of defence

1 A captcha before sending the code. It is the cheapest brake on bots. Put it on the “Send code” button, not only at the end of the form.
2 Limits in your system per IP and per session. A person does not need codes for ten different numbers in a few minutes. Above your limit, do not call the API.
3 The account rules in the API. Turn on the wait between resends and the maximum codes per number per hour; by default they are off (see limits against abuse).
4 Ask for the code only when needed. After the right password, not before; at the end of checkout, not on the first page.
5 Watch the balance. GET /v1/sms/balance returns your credit balance. An alert in your system when the day's use goes beyond normal warns you before the balance runs out.

One help comes built in: the API only accepts numbers in Mozambique and Angola. Numbers from other countries, which are often behind this kind of fraud, never go out.

The key's spending limit does not cap SMS credits. That limit is in currency and does not apply to the credits in your SMS balance. So the brakes have to be the ones above: your form, the account rules and a watched balance.

If it is already happening

1 Turn on the account rules now, in Meu MozOut (API keys page) or with PUT /v1/sms/otp-settings.
2 Switch off the “Send code” button on your site while you add the captcha and the limits.
3 If you suspect the key was copied, revoke it and create another: see a leaked API key.
4 Talk to us: open a support ticket with the times and volume of the attack.
Test the brakes in the Sandbox. There you can fire your form as often as you like, watch the limits work and not spend a single credit.

Seeing SMS use you do not recognise? Talk to us and tell us the times and the volume.

Open a support ticket

SEE ALSO

Limits against abuse: codes per number per hour and the wait between resends

How much SMS verification costs: credits per code, free checks and a monthly estimate

Code-sharing scams: protecting your customers from people who ask for their SMS code

Resending, cancelling and replacing a verification code: what happens to the old one

An API key or token has leaked: what to do, in the right order

Sending one-time codes (OTP) by SMS safely: expiry, attempt limits and logs

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 645 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 546 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 769 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
Security 572 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 511 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 18 Code-sharing scams: protecting your customers from people who ask for their SMS code The short answer: an SMS code only protects while it stays on the customer's phone. The most common scam does not attack...