Cost & Security
6 min readAug 20, 2025

Why SMS Verification Is Expensive - and the Hidden Risk of AIT

For many years, SMS was the default channel for phone verification. But if you've scaled a product internationally, you already know the pain: SMS costs add up fast. What's worse, fraud schemes like Artificially Inflated Traffic (AIT), or SMS pumping attack, can silently drain your budget.

SMS verification illustration showing phone with message notification

For many years, SMS was the default channel for phone verification. But if you've scaled a product internationally, you already know the pain: SMS costs add up fast. What's worse, fraud schemes like Artificially Inflated Traffic (AIT), or SMS pumping attack, can silently drain your budget. In this article, we'll break down why SMS is so costly, what AIT is, and how to protect your business.

The True Cost of SMS Verification

Unlike internet-based messaging, SMS relies on mobile network operators (MNOs), who set fees per message. The Phone operator of a given number is unique, and is in a monopolistic situation to reach their users. So they could theoretically set the price unilaterally, and they sometime do!

Costs vary depending on:

  • Destination country: Some regions charge up to 10× more for international SMS.
  • Carrier interconnect fees: Each operator in the chain adds its markup.
  • Delivery uncertainty: Even at high prices, there's no guarantee your SMS won't be delayed or filtered.

For global SaaS products, SMS quickly becomes a major operational expense - especially when many verifications fail or require retries.

What Is AIT (Artificially Inflated Traffic)?

AIT is a type of telecom fraud where bad actors exploit SMS-based services to generate fake traffic and inflate costs. Here's how it typically works:

  1. Fraudsters sign up for your service using phone numbers hosted on rogue carriers.
  2. Your app sends an SMS verification code.
  3. The carrier completes the delivery, bills you, and shares revenue with the fraudster.

The result? You pay for thousands of fake verifications - with no real users behind them.

Why AIT Is Dangerous

  • Direct financial loss: Companies have lost hundreds of thousands of dollars to AIT in a matter of weeks.
  • No added value: Unlike real fraud attempts, AIT doesn't even create fake accounts — it just drains your SMS budget.
  • Hard to detect: Many AIT numbers look legitimate until you analyze traffic patterns.

The WhatsApp Advantage

By switching from SMS to WhatsApp-based verification, businesses can:

  • Avoid carrier-based fraud: WhatsApp traffic doesn't go through telecom billing chains.
  • Lower costs: WhatsApp messages are significantly cheaper across most regions.
  • Improve security: End-to-end encryption and business account verification make fraud harder.

Best Practice: Hybrid Strategy

  • Use WhatsApp verification by default for cost savings and security.
  • Keep SMS as a fallback for users who don't have WhatsApp.
  • Monitor traffic with fraud detection tools to catch anomalies early.

Implementing a hybrid strategy allows businesses to enjoy the benefits of both SMS and WhatsApp verification while mitigating the risks associated with each.

NB: It would also be possible to totally block AIT by asking non WhatsApp users to send an initial SMS directly. As Mobile Originated SMS can't be considered as secure, you would then send a real MT OTP to the detected number. This would drastically increase cost for attackers while limiting the user experience impact.

Conclusion

SMS verification still has its place, but it's becoming increasingly expensive and vulnerable to fraud schemes like AIT. Businesses that rely solely on SMS risk paying the price — literally.

Switching to WhatsApp-first verification, with SMS as a fallback, is the modern best practice for SaaS companies that care about cost, compliance, and user trust.

How Phone-verif.com Helps

With Phone-verif.com, you can:

  • Protect against AIT fraud with WhatsApp-based verification.
  • Keep costs low with international-friendly verification.
  • Stay GDPR-compliant with minimal data retention.