Twilio SMS pumping: unexpected SMS charges
Signs it's happening- A spike of messages to blocks of adjacent numbers, often in countries
you don't serve
- OTP messages sent, but no verification ever completed
- Error 30450 (SMS Pumping Protection) or 60410 (Verify Fraud Guard)
in your logs once protection is onBots are using a phone number field on your site to make you send SMS to numbers that earn them money. Turn off countries you don't serve, enable Twilio's fraud protection, and rate limit the form.
Why it happens
Twilio describes SMS pumping as fraudsters abusing a phone number input (for one-time passcodes, app links and similar) to trigger texts to numbers they profit from. Each message costs you; the attacker never completes sign-up.
Any public form that sends an SMS without limits is a target: sign-up, login by code, "text me the app".
Fix it by hand
- Confirm it. In your Messaging logs, look for many messages to similar numbers in unexpected countries, and for verifications that were started but never completed.
- Turn off countries you don't serve. In the Console go to Messaging, Settings, Geo Permissions and untick them. If you use Verify, review the Verify Geo Permissions too. Only account owners and admins can change these, and not through the API.
- Enable fraud protection. For Programmable Messaging, enable SMS Pumping Protection under Messaging, Settings (Twilio lists no extra charge for the US and Canada; check pricing for other countries). For Verify, turn on Fraud Guard in the service's SMS settings. Blocked sends show error 30450 or 60410.
- Rate limit the form. Limit SMS sends per IP, per phone number and per session, and add a bot check (such as a CAPTCHA) before sending.
- Send only to mobile numbers. Twilio suggests checking the line type with Lookup before sending.
- Get notified sooner. A Twilio Usage Trigger calls your webhook when usage passes a threshold, typically within a minute. It only notifies: your handler must take the action.
Stop it happening again
- Allow only the countries you actually serve from day one.
- Put rate limits and a bot check on every endpoint that sends an SMS.
- Prefer Verify with Fraud Guard for one-time codes.
Bill Spiked $7
Bill Spiked flags endpoints that send SMS with no rate limit or bot check, and gives the Twilio checklist (geo permissions, fraud protection, usage triggers) along with the other paid providers in your code.
- Finds the uncapped calls, loops and open endpoints that run up a bill, ranked by how much damage each can do.
- Adds the limits as diffs you approve, and gives a spending-cap checklist for each paid provider in your code.
- Verdict first. Every finding shows the file and line, what it breaks, and the fix as a diff that is applied only with your OK.
Bill Spiked: how it works, with examples · Install guide
Works with Claude Code, Claude.ai, Cursor, Codex and other agents that read SKILL.md files. No installs, no accounts, works offline. No-questions refund.