Back to blog
Are you sending messages via SMS or RCS to your customers? Are those messages part of an automation like for example login codes? Then you might be a target for messaging fraud...
What Are Fraud Risks For Automated Messaging?
Criminals seek to abuse automated login systems (like one time passwords (OTPs) sent by SMS) to generate fake traffic to make money. This type of fraud is known as Artificially Inflated Traffic (AIT), SMS pumping or traffic pumping. How does it work? Businesses typically send OTP's automatically when a user logs in, resets a password, or when they create an account. And each message sent costs the business money. Fraudster are of course not interested in the actual OTP, but they just want the business to pay for sending it - and they'll profit of it through corrupt SMS routes, compromised partners, or SMS numbers they control.
These messaging costs can add up fast - regardless the size of your business. When an AIT attack hits, it hits hard! In fact, global AIT fraud losses are estimated to be several billion dollars between 2022-2024. Even amongst CM.com customers, we see an average of 20k in fraudulent traffic costs if no fraud prevention measures are taken.
At CM.com, we are committed to protecting our customers from messaging fraud by monitoring and blocking suspicious activity 24/7. However, fraud prevention is a shared responsibility. We provide the tools and options to mitigate risks, but it’s essential that customers work with us to configure these measures effectively. Together, we can ensure that criminals are unable to profit from illegal traffic and create a safer messaging environment.
- Brian de Liefde, PO Messaging Platform at CM.com
What to Do Against AIT?
There are several things you can do to protect your business from AIT attacks:
Secure the trigger, not just the message. Adding CAPTCHA or bot detection to login and password reset forms will make it more difficult to send large volumes of OTPs in one time.
Put restrictions on your traffic volumes. Rate limiting will help you control how many messages are being sent in a specific timeframe - and this can be done in many different way. You can limit how many messages in total can be sent, but also how many per user accounts, or per individual user.
Proactively block high-risk destinations. What makes a destination high-risk? Well, destinations are more likely to be targeted if they have high SMS rates (more money per message), limited regulations and therefore less control on revenue-sharing or grey SMS routes. And of course, destinations where you have no customers should not receive SMS traffic from your business either.
Monitor your traffic to signal abuse early. Insight in your traffic-flows will help you detect unusual activities, and when you know that something suspicious is happening, you can act accordingly.
These fraud preventative measures can be implemented in many different ways, but you can roughly divide it in two types: Static and Dynamic protection.
Static vs Dynamic Fraud Protection
Static fraud protection simply means setting up strict rules and restrictions for your messaging traffic. This includes setting hard limits to your messaging traffic volumes, restricting IP-address access, and creating block- and allow-lists for your destinations. CM.com offers static fraud protection in a software suite called Safeguard. Safeguard offers:
IP address restrictions - Mitigate risks by restricting access to your messaging platform account.
Destination management - Create Block and Allow lists to preemptively block traffic from high-risk destinations
Rate limiting - Control the amount of messages being sent in a specified timeframe and prevent uncontrolled high spikes that drive up the costs.
Static fraud prevention works well for a majority of businesses, especially for those with relatively straightforward traffic flows. However, it isn't always this black-and-white.
Are your customers located in possible high-risk destinations? Do your messaging volumes differ greatly from day-to-day? Do you serve customers worldwide? Then static fraud prevention can unintentionally get in the way of legit messaging traffic. In these cases, a more dynamic solution would be a better fit.
CM.com offers Safeguard Plus as a dynamic fraud prevention software suite. It leverages advanced machine learning to provide a more customized protection against messaging fraud:
Dynamic traffic profiling - By continuously analyzing messaging patterns, Safeguard Plus can identify irregularities and flags potential issues. How? By checking a combination of destination classification (high-risk vs low-risk), deviations in traffic destinations, anomalies in conversions, odd number ranges, and supplier reliability.
Flexible block and monitor modes - Monitor your traffic without immediately making changes to the flow, and automatically block when suspicious activities are flagged.
Clear and actionable data insights - Get real-time insights in your traffic flows via detailed dashboards and reports, so you can make informed and quick decisions regarding your messaging traffic.
What Does Your Business Need?
The big difference between static and dynamic fraud protection is the flexibility. But which one do you need for your business? It may not even be a straight answer. Static protection helps minimize risks but can restrict your business when risks arise. On the other hand, dynamic protection removes these limitations, offering a valuable enhancement to static protection, especially for businesses operating on a global scale. That said, having basic static protection in place is essential. And when fraudsters target your business, don’t hesitate to strengthen your defenses by adding dynamic protection to stay one step ahead.
Want tailored advice on your fraud prevention strategy? Click the button below and contact our experts to discuss your specific use case. Our experts are here to help.
