T1496.003: SMS Pumping
Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.[1] SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.[2]
Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.[1][3] In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.[1]
Analyst context for executives and security teams
SMS Pumping turns ordinary SMS verification or OTP workflows into a business-cost and availability problem. An adversary can drive large volumes of messages through a SaaS-backed messaging path so the victim pays increased SMS fees and legitimate communication channels may be overwhelmed. For leaders, the key issue is not only fraud loss; it is whether customer signup, account recovery, verification, and notification processes can be abused faster than the organization can detect, throttle, and respond.
Executive priority
Treat this as an impact and resource-hijacking risk for any SaaS application that sends SMS through public forms or account verification flows. Executives should ask who owns SMS spend monitoring, abuse response, and customer-impact decisions when message volume spikes. Security, engineering, fraud, and finance teams need shared thresholds and evidence so cost anomalies, degraded verification workflows, and incident response actions can be justified for resilience and audit purposes.
Technical view
ATT&CK identifies this as a SaaS sub-technique of Resource Hijacking under the Impact tactic. Because the official technique has no ATT&CK-provided detection text, validation should be anchored to the related detection strategy, DET0156, for SMS pumping via SaaS application logs. SOC and detection teams should confirm they can correlate application events from OTP, account verification, and public web forms with messaging-service activity, destination phone-number patterns, request rates, error responses, and billing or usage anomalies. IR teams should also validate escalation paths for disabling, throttling, or challenging abusive SMS-generating flows without unnecessarily breaking legitimate account access.
Likely telemetry
- SaaS application logs for public web forms, OTP requests, account verification, signup, and account recovery flows
- Messaging-service logs or usage records for SMS send attempts, destinations, delivery status, and volume changes
- Billing, cost, or quota telemetry tied to SMS messaging services
- Web request metadata associated with SMS-triggering endpoints, including request rates and source characteristics where collected
- Authentication or identity workflow logs for verification-code generation and validation outcomes
Detection direction
- Validate DET0156-style monitoring against SaaS application logs for SMS-generating workflows rather than relying only on generic infrastructure alerts.
- Baseline normal SMS request volume by application flow, geography or destination patterns where available, time of day, and campaign or business events to reduce false positives.
- Tune for rapid increases in SMS sends, repeated OTP or verification requests, unusual destination concentration, high send-to-success imbalance, and cost or quota spikes.
- Correlate application-layer events with messaging-provider usage and billing records; either source alone may miss the business impact or the triggering user journey.
- Account for legitimate spikes from product launches, marketing campaigns, outages, or customer migrations before escalating as malicious activity.
Mitigation priorities
- Apply application developer guidance to SMS-triggering workflows: design abuse resistance into OTP, signup, account recovery, and verification paths.
- Prioritize rate limits, friction, validation, and workflow controls around public forms that can generate SMS traffic.
- Set spend, quota, and volume thresholds with clear owners for security, engineering, finance, and service operations.
- Build response playbooks for throttling or temporarily changing SMS verification behavior while preserving legitimate customer access where possible.
- Review logging and retention requirements so incidents can be investigated with application, messaging-service, and billing evidence.
Analyst notes and limits
The supplied ATT&CK object is new in version 1.0 and focuses on SaaS-hosted SMS abuse as an impact technique. The most useful relationship context is its parent, T1496 Resource Hijacking, and the related detection strategy DET0156. The mitigation relationship points to Application Developer Guidance, so defensive emphasis should be on secure application design and operational guardrails for SMS-generating features.
The official ATT&CK detection field is not provided, and the supplied data does not establish specific adversary groups, active exploitation, affected vendors beyond cited examples, or guaranteed detection methods. Local application architecture, messaging-provider configuration, logging coverage, and business SMS usage patterns are required to assess exposure and detection quality.
SMS Pumping
Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.[1] SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.[2]
Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.[1][3] In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1496 | Resource Hijacking | This object subtechnique of Resource Hijacking. |
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 9100934bcfba… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Twilio SMS Pumping
Twilio. (2024, April 10). What Is SMS Pumping Fraud and How to Stop It. Retrieved September 25, 2024.
Open source URL -
[2]
Twilio SMS Pumping Fraud
Twilio. (n.d.). What is SMS Pumping Fraud?. Retrieved September 25, 2024.
Open source URL -
[3]
AWS RE:Inforce Threat Detection 2024
Ben Fletcher and Steve de Vera. (2024, June). New tactics and techniques for proactive threat detection. Retrieved September 25, 2024.
Open source URL -
[4]
mitre-attack T1496.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.