The AIT problem

The AIT problem

One of the key topics and discussion points that has been ever present at many of the industry events I have attended this year is one of Artificial Inflated Traffic (AIT), also known as SMS Pumping.

AIT is not a new fraud but it is continuing to rise sharply and can affect any business, large or small, that uses A2P SMS for verification via One-Time Passcodes (OTPs) or to communicate and engage with its customers.

AIT even appeared in mainstream news earlier this year when Elon Musk said that Twitter lost $60 million per year due to AIT and subsequently removed all SMS based identity verification (OTPs).  Other global brands are also starting to withhold payments from their SMS aggregators and mobile networks in an attempt to cover their fraud exposure.

So what is AIT? And what can be done to prevent it?

AIT exploits SMS messages delivering one-time passcodes (OTPs) which are most often used for verifying customer mobile phone numbers during the registration process.  In the Twitter example fraudsters generated fake SMS OTPs by creating a huge amount of bot accounts.  The fraudsters then received a share of the revenue generated to their complicit partners, often based in high-cost faraway destinations.

There is a certain irony with AIT as despite the cost associated with this type of fraudulent traffic, many companies in the telco ecosystem can be a potential beneficiary. Additionally, whilst enterprises are usually the victims of this type of fraud, there are a few who use it to boost their own subscriber base to demonstrate growth.

However, in the longer term, AIT is leading to reduced trust in SMS for delivering OTPs, revenue loss for enterprises and lower volumes damaging the industry. The global body, The Communications Fraud Control Association (CFCA) estimated that AIT resulted in losses of over $6.7 billion in 2021.

But all is not lost and there are ways that SMS aggregators, mobile network operators and enterprises can help detect and prevent AIT.

As an example, at TMT we have developed a global numbering and fraud prevention solution TeleShield which can help to:

• Identify the line type allocated by the local regulator, and only send SMS to mobile numbers;
• Provide a real-time check of the Caller ID (or A Number) to check if it’s an invalid number;
• Confirm if a number has been assigned to a subscriber and is therefore ‘active’;
• Block premium rate numbers;
• Use machine-learning to detect unusual spikes in activity, whether that is the timing of messages, volume of messages, location or to blocks of adjacent numbers.

Enterprises can also help by detecting bots using CATPCHAs and monitor OTP conversion rates. They could also use other methods as an alternative to SMS based-verification, like TMT’s Authentication service. This new method of proving the possession of a mobile phone number does not need A2P SMS / OTP and therefore stops AIT as well as improving security and making life easier for customers.

It is critical that enterprises, SMS aggregators and operators all work together to help prevent this type of fraud and protect the industry from financial losses. The loss in trust and reputation for SMS as a channel will also cause volumes to sharply decline as enterprises move to OTT channels and other verification services.