SMS fraud is not a niche problem for telecoms security teams to manage quietly in the background. It is a direct financial threat to any business that uses text messaging at scale — and in 2026, that means most businesses. Global losses attributable to SMS fraud are projected to reach $71 billion this year, and the attacks driving those losses are more sophisticated, more automated, and harder to detect than anything the industry has faced before.
What makes this particularly challenging is that the threat landscape is changing faster than most organisations' defences. AI-powered smishing campaigns now achieve click-through rates of up to 54% — a figure that reflects not just the volume of attacks but their quality. These are no longer generic phishing attempts that trained eyes can spot easily. They are personalised, contextually accurate messages that arrive looking and sounding exactly like communications from a trusted institution. Alongside them, SMS pumping fraud has become the most financially damaging threat to businesses using SMS for verification and authentication — draining budgets silently and invisibly until an invoice arrives that is several times what it should be.
Understanding the fraud landscape — what each attack type is, how it operates mechanically, and what early signals to look for — is the prerequisite for defending against it effectively.
What SMS Fraud Actually Is
SMS fraud is the exploitation of text messaging infrastructure, business systems, or human psychology for financial gain. Fraudsters target weaknesses at three distinct levels: the technical infrastructure that carries messages, the business systems that trigger them, and the people who receive them.
The channel's near-universal reach is precisely what makes it attractive to criminals. SMS works on every phone type, requires no app installation, delivers messages almost instantly, and carries an inherent sense of legitimacy that other digital channels have eroded through overuse and abuse. These are the same properties that make it valuable for legitimate business communication — and the same properties that fraudsters exploit.
The Mobile Ecosystem Forum has catalogued fourteen distinct types of SMS fraud. The following are the most significant for businesses to understand in 2026.
The Major Types of SMS Fraud
Smishing
Smishing is SMS phishing — fraudulent messages designed to manipulate recipients into clicking malicious links, entering credentials on fake websites, or downloading malware. It now accounts for 70% of all mobile phishing attacks, and SMS-originated scam reports grew 40% year-on-year in 2025.
The most dangerous evolution is AI-powered personalisation. Fraudsters use breached databases and publicly available social media data to generate messages that feel genuinely personal — referencing the recipient's bank by name, citing a recent transaction, and linking to a cloned login page that is visually indistinguishable from the real thing. Criminal networks operating hundreds of thousands of fraudulent domains rotate their infrastructure faster than blocklists can track. Around 41% of these attacks now combine SMS with follow-up phone calls or emails to add further layers of apparent legitimacy.
For businesses, the smishing threat operates on two fronts simultaneously. Customers may receive messages impersonating your brand, generating reputational damage and support burden. Employees may be targeted by messages impersonating internal teams — IT helpdesk, HR, finance — as an entry point for credential theft or fraudulent payment authorisation.
SMS Pumping Fraud
SMS pumping — also known as Artificially Inflated Traffic or AIT — is the most directly costly fraud type for businesses running SMS verification flows, and it is specifically designed to be invisible until significant damage has already occurred.
The mechanics are straightforward. A fraudster establishes a revenue-sharing arrangement with a premium-rate carrier. They then flood a business's SMS-triggering endpoint — typically a one-time password or phone verification flow — with real phone numbers registered to that carrier using automated bots. Every OTP message sent is billed to the business at the standard rate. The fraudster collects their revenue share from the carrier. The business pays for thousands of messages that were never requested by real users.
Critically, the messages are actually delivered. This is not fake delivery confirmation against nonexistent numbers. Real numbers receive the OTPs, which is why standard delivery monitoring misses the fraud entirely. What it does not catch is that the codes are never entered — because there is no real user on the other end. A single undetected pumping campaign can generate tens of thousands of pounds in fraudulent charges within a matter of hours.
SIM Swapping
SIM swapping attacks the authentication layer itself. A fraudster contacts a victim's mobile operator, impersonates the account holder using social engineering and data from prior breaches, and convinces the operator to transfer the number to a SIM they control. From that point, they intercept every SMS sent to that number — including OTP codes for banking, email, and any other account using SMS-based two-factor authentication. The legitimate owner's phone loses signal, often without an immediate explanation.
For financial services businesses in particular, a successful SIM swap can result in complete account takeover within minutes. Real-time SIM swap detection services — which monitor for recent port activity and alert businesses when a customer's SIM has changed — provide a critical defensive layer by flagging suspicious authentication attempts at the exact moment they occur.
SMS Spoofing
SMS spoofing involves altering the sender information displayed to the recipient so that a message appears to come from a trusted organisation rather than its actual origin. Fraudsters use this to make smishing messages appear in the same conversation thread as genuine communications from a bank or delivery company — lending them a credibility they would not otherwise carry. A common variant involves faking payment confirmation texts to facilitate purchase fraud on buy-and-sell platforms.
Grey Routes and SMS Trashing
Grey routes exploit the pricing gap between A2P and P2P SMS infrastructure. Business messaging traffic — which should be carried at commercial rates — is misrouted through cheaper person-to-person infrastructure, with the cost difference captured as fraudulent margin. For businesses, the practical impact is degraded delivery quality, inconsistent sender IDs, and potential compliance failures.
SMS trashing is carried out by rogue aggregators who accept messages from businesses, charge for delivery, and then discard them without transmitting to the carrier. Delivery and engagement metrics decline gradually. The fraud is frequently attributed to other causes before the aggregator's behaviour is identified.
How to Detect SMS Fraud Early
Each fraud type leaves distinct signals. Knowing what to look for — and monitoring for it systematically — is the difference between catching an attack early and discovering it on a monthly invoice.
For SMS pumping, the clearest signal is a spike in send volume that is not accompanied by a corresponding increase in successful verifications or actual user activity. If your OTP conversion rate — the proportion of codes sent that are actually entered and verified — drops below approximately 20%, a meaningful proportion of your sends are likely not reaching genuine users. Additional indicators include traffic concentrated in unusual country codes, request bursts outside normal usage hours, sequential number ranges in OTP requests, and multiple verification attempts from the same IP address or device fingerprint within a short timeframe.
For smishing and spoofing, your fastest detection channel is your own customers. A reporting mechanism that makes it easy for recipients to flag suspicious messages appearing to come from your brand will surface spoofing incidents far faster than any internal monitoring system. An uptick in support contacts about unexpected messages, or unusual login activity following high SMS send volumes, should both prompt immediate investigation.
For SIM swapping, watch for unusual authentication behaviour — particularly high-value account actions initiated shortly after a SIM change on the relevant number. Real-time detection services make this monitoring automated rather than reactive.
For grey routes and SMS trashing, monitor delivery rate metrics continuously. A decline in successful deliveries or a rise in undelivered messages without a clear network explanation warrants a review of your routing path and aggregator practices.
The Prevention Framework
Effective SMS fraud prevention requires layered defences. No single control addresses all attack types, and fraudsters actively probe for gaps in single-layer defences.
The Bottom Line
SMS fraud in 2026 is more sophisticated, more automated, and more expensive than it has ever been — but it is also more detectable and more preventable than ever, for organisations that treat it as an ongoing operational discipline rather than a periodic compliance exercise. The businesses that suffer the largest losses are consistently those that discovered the fraud on an invoice rather than in their monitoring dashboards. The gap between those two outcomes is the investment in layered controls, real-time visibility, and the organisational awareness to recognise when something is wrong before it becomes something costly.
