Protecting Phone Verification
summary
A specific attack called SMS pumping floods phone-verification forms to generate billing events by targeting sequential number blocks tied to complicit carriers that pay carrier kickbacks, costing victims tens to hundreds of thousands of dollars. Indicators include spikes to one carrier, many one‑time passcodes sent but not completed, and a sudden drop in OTP conversion rate. Defenses: require email confirmation first, prefix- and geo-based rate limits, resend delays/exponential backoff, carrier lookups, and provider-level blocking.
AI-written summary · about
chapters (6)
- 0:00Introduction to SMS pumping
- 5:01How SMS pumping works
- 10:46The role of carriers
- 14:16Telecom toll fraud
- 15:25Strategies for prevention
- 26:45Conclusion and resources
related talks
48m2FA2Furious: New Threats to MFA
30mAuthentication Strategies to Protect Your Customers and Your Brand from Sophisticated Attacks
33mSMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets
42mThe Old is New Again: An Intro to SMS Security and Why It’s Vital
36mBuilding Bulletproof 2FA with Twilio APIs
37mYour Phone is Not Your Phone: A Dive Into SMS PVA Fraud
05mAn Empirical Study of Wireless Carrier Authentication for SIM Swaps
25mAuthentication Beyond SMS