Skip to content

SMS pumping and toll fraud: what the numbering plans can stop

SMS pumping turns a signup or login form into income for someone else. A script asks for one-time codes for thousands of numbers in ranges whose operator, or a party on the route, shares the fee for delivering the message with the attacker. You pay for every message, and no one ever types a code. Toll fraud, or international revenue share fraud, is the same with calls: a verification call to a premium-rate or high-cost range earns its holder money.

What the plans let you limit

  1. A text goes only to a mobile range. Most fixed lines cannot receive a text, and a premium-rate, shared-cost, personal-number or UAN range has no reason to receive a code. The +1 plans cannot tell mobile from fixed line, so their numbers stay in.
  2. Only to the countries you serve. A service with users in one country has no reason to text the other 244 plans. The country comes from the number's plan, not from the address the request came from.
  3. One counter per block of numbers. Pumping walks through a range: …123456, …123457, …123458. Count the codes sent per block of 10,000 numbers, the national number without its last four digits, and slow down a block that suddenly asks for many. In +1 that block is the central office code, the first six digits.
  4. No verification call to the costly ranges. 150 of the 245 plans have premium-rate ranges, 53 shared-cost, 59 personal-number and 63 UAN ranges. The line type from parse names them before the call is placed.

The code

Two additions to the guides' file: mayTextTo for the first two limits, rangeKey for the counter's key; the counter itself lives wherever your service counts things. A service in the United Kingdom, with the United Kingdom, the United States and France loaded:

NumberLine typeCode sentCounter key
+44 7400 123456mobileyes+44 740012
+44 7400 123457mobileyes+44 740012
+44 7400 123458mobileyes+44 740012
+44 70 1234 5678personalNumberno+44 701234
+44 901 234 5678premiumRateno+44 901234
+44 121 234 5678fixedLineno+44 121234
+33 6 12 34 56 78mobileno+33 61234
+1 201-555-0123fixedLineOrMobileno+1 201555

The three numbers in a row share one key: three requests count against one block.

Add it at the end of phone.mjs, the file from the JavaScript guide:

// A one-time code goes only to a mobile range in a country you serve (ISO codes such as GB).
export const mayTextTo = (n, countries) =>
  (n.type === 'mobile' || n.type === 'fixedLineOrMobile') && countries.includes(n.region)

// One counter per block of 10,000 numbers: the country code and the national number without its last four digits.
export const rangeKey = (n) => `+${n.cc} ${n.nsn.slice(0, -4)}`

Sources: National numbering plans, ITU-T E.164 (ITU); National Telephone Numbering Plan (Ofcom). Plans as published on 2026-10-25.