The economics of SMS OTP phone verification is simple: a business pays for each OTP message that is sent, and not each user successfully verified.
When the technology was built, it assumed that each request came from a genuine user – and that used to work. But the landscape has changed.
Today, with AIT fraud, fraudsters generate fake OTP requests at scale, and businesses still pay for every message they trigger. With that, it’s time for the economics to change, too.
Instead of paying for messages sent, it’s more cost-effective to pay for each successful authentication outcome.
What Is AIT Fraud?
Artificially inflated traffic fraud, or AIT fraud, happens when fraudsters generate A2P SMS traffic that looks like real customer activity (but isn’t).
In authentication flows, this usually involves bots or automated systems that trigger large volumes of OTP requests for registrations, logins or password resets, resulting in charges for messages that were never requested by genuine users.
What’s more, today even fraudulent SMS OTP requests can be completed successfully.
Attackers are also using automations to complete entire verification workflows and successfully submit OTPs, changing what a successful verification means.
A delivered OTP confirms that a message reached a number. A correctly submitted OTP confirms that someone or something has the code. But neither result guarantees that a genuine customer was behind the request.
The fraudsters earn from the traffic sent through high-cost destinations, traffic-sharing arrangements or manipulation elsewhere in the messaging chain, and the resulting losses are significant.
The MEF Anti-Fraud Yearbook 2024 estimates that AIT accounted for around 5% of international A2P traffic in 2023, resulting in $2.4 billion in losses for businesses between 2022 and 2024 while separate research from Enea and Mobilesquared estimated AIT at 4.8% of international messaging traffic, costing about $1.16 billion in 2023.
The numbers differ slightly, but the point is the same: a meaningful share of international A2P traffic is being generated without a genuine customer behind it.
How to Stop AIT Fraud
Here’s the big problem with SMS-first authentication: the cost can be incurred before the business knows whether there is a real user behind the request.
Once the OTP is sent, the message is billable. For an AIT attacker, triggering that message can already be enough.
The most effective way to reduce OTP-driven AIT is therefore to avoid sending the SMS unless it is actually needed.
Network-based Number Verification verifies users by checking the phone number directly through the mobile network. Instead of sending a code and waiting for the user to return it, the GSMA Open Gateway Number Verification API performs this check against the number and the SIM in the user’s device.
When network verification succeeds, there is no OTP to generate and no SMS traffic to inflate.
That being said, SMS still has a role where network verification cannot be completed. Coverage, connectivity and local market conditions mean that no single authentication method reaches every user today.
And when SMS is still needed, we can make that flow better too.
Rather than acting only as the delivery channel, the operator can generate the OTP and validate the code submitted by the user. The GSMA Open Gateway OTP Validation API provides one endpoint for sending the code and another for validating the code submitted by the user.
In traditional SMS OTP flows, an intermediary involved in message delivery may be able to capture the OTP and feed it back into the automated verification flow, making a fraudulent request appear successfully completed.
With the OTP Validation API, the operator generates and verifies the OTP, removing the need for businesses to rely on intermediaries and minimizing risks of fraud.
In practice, the model is pretty simple:
Network-based authentication first. Operator-controlled SMS OTP when necessary.
Turn Authentication Spend Into Verified Customer Outcomes
For businesses, the logic is pretty straightforward: authentication spend should pay for a successful outcome, not just an authentication request.
A network-first model moves authentication in that direction.
At MWC26, Meta reported Number Verification conversion rates of 80% to 95%, compared with 60% to 75% for SMS OTP in its strongest markets and below 50% in some high-cost or high-risk markets.
GSMA also reported that Telin, our partner, increased successful phone-number verification by more than 20% after adding an API-based authentication mechanism alongside OTP. The same is happening with various companies we partner with, like BRI Bank in Indonesia, which reported a 20% higher conversion rate than with SMS OTP.
And that’s just it – ultimately, authentication spend should result in real identities successfully verified with fewer unnecessary SMS costs and less exposure to artificially generated traffic.
IPification helps enterprises and operators build that model across multiple networks and markets, using programmable, network-based verification as the primary channel and controlled SMS fallback where it is still required.
That gives businesses a single point of entry to mobile networks, with the authentication flow handled behind the scenes: which verification method is available, which one should be used first, and when to move to the configured fallback.
We can help you move beyond SMS-first number verification. Schedule a quick intro call!
