SMS Pumping in Dubai (2026): Why Your OTP Bill Tripled Without One New User

Short answer: If your UAE app's one-time-password spend jumped while signups stayed flat, you are almost certainly being pumped. SMS pumping — the industry calls it artificially inflated traffic, or AIT — is a bot farm hammering your “send me a code” endpoint so that someone collects a cut of each message you pay for. Independent estimates put 4.8% of all international A2P SMS traffic in the fraud bucket, and because a UAE-destined segment costs roughly AED 0.43 against about AED 0.03 in the United States, a Dubai sender bleeds faster than almost anyone.

The fix is not a vendor. It is six controls on your own signup flow, and most teams can ship them in under two weeks.

The numbers that set the stakes

This is not a fringe problem that happens to other people's apps.

• Between 19.8 billion and 35.7 billion fraudulent AIT messages were sent in a single year, costing brands around USD 1.16 billion in delivery fees, according to the joint Enea and Mobilesquared white paper on artificially inflated traffic. That is 4.8% of international A2P traffic — roughly one message in twenty.
• Juniper Research puts peak enterprise losses to AIT at USD 2.1 billion, and forecasts a 55% decline between 2024 and 2029 as detection improves and global A2P SMS volume falls from 1.9 trillion messages to below 1.5 trillion. Note what that forecast means for you: the decline is driven by companies that actually deployed defences. It is not automatic.
• Elon Musk said Twitter was losing USD 60 million a year to exactly this attack before it audited its verification traffic. If a platform with that engineering budget missed it for years, a Dubai scale-up with a Twilio account and no alerting will miss it too.

Messaging vendors see it from the other side. Soprano, Sinch and 8x8 have all published figures in the same range: for some large brands, 30% to 60% of generated verification traffic is flagged as artificially inflated. Treat those as vendor estimates rather than audited numbers — but even the floor of that range would double your bill.

How the scam actually works

Every OTP is a payment instruction. When your app sends a code, your messaging provider pays the destination mobile operator to terminate it, and you pay your provider. In most of the world that termination fee is trivial. In a handful of small operators it is not, and those operators share revenue with whoever brings them traffic.

So the attacker does three things:

• Acquires or rents number ranges on an operator with a generous termination rate, usually in a small market with light regulation.
• Finds an unprotected POST /send-otp endpoint — yours. No login required, no CAPTCHA, no per-IP cap, happy to accept any country code.
• Scripts millions of requests. Nobody ever reads a code. Nobody ever completes a signup. The attacker takes a share of the termination fee, and you get the invoice.

Most Dubai businesses get this wrong: they read a spike in OTP sends as a spike in demand. It is the opposite signal. Real traffic converts — a healthy consumer app sees 80% or better of sent codes actually entered. Pumped traffic converts at close to zero, because no human is on the other end. If your send volume is up 300% and your verification completion rate has collapsed, that is not a marketing win. That is the attack's signature.

The second signature is geography. A Dubai-only delivery app that suddenly sends a third of its codes to +211 (South Sudan) or +678 (Vanuatu) is being pumped, not going international. Industry risk lists repeatedly name the same destinations — Central African Republic, Zimbabwe, Gambia, Timor-Leste, Tajikistan, Mongolia, Kiribati, Niue, Bolivia, Paraguay. None of them are plausible markets for a Business Bay salon booking app.

Why a UAE sender gets hurt more

Here is the asymmetry nobody mentions when they sell you SMS. Per-segment pricing to UAE numbers from the major CPaaS providers sits around USD 0.10 to 0.12 — Twilio was checked at USD 0.1176 per outbound segment in September 2026, with Sinch at about USD 0.1074 and Infobip near USD 0.10. Call it AED 0.40 to 0.43. The equivalent US segment is about USD 0.0083, or roughly AED 0.03.

That is a 14x gap on the same message. Then add the UAE's fixed compliance overhead: sender IDs must be registered separately with e& and du, Etisalat's published fee schedule runs AED 500 one-time setup plus AED 100 per month per sender ID, Twilio charges a further USD 225 setup and USD 115 per month for an alphanumeric sender ID, and Infobip charges around EUR 150 per active sender or service ID. Approval itself takes 5 to 10 business days for a UAE-licensed company and 20 to 25 business days for an international entity as of early 2026, promotional IDs need the AD- prefix, and any sender ID dormant for more than six months is deactivated.

Translated into one night of being pumped: 50,000 fraudulent sends at AED 0.43 is AED 21,500, gone, in the hours between your last deploy and your first coffee. At the 500,000-message scale that a serious bot farm reaches over a weekend, you are looking at AED 215,000 — and if the destinations are high-payout rather than UAE-local, the per-message rate is often worse, not better. For most Dubai SMEs that single weekend exceeds the entire annual cost of building the controls described below.

The channel maths: what a verification should cost you

SMS is the most expensive way to deliver a six-digit number to a UAE phone. This is the current rate card, in AED, at an exchange rate of 3.6725 to the dollar.

Channel (UAE destination)	Cost per message	In AED	Notes
SMS, major CPaaS	USD 0.10–0.1176	AED 0.37–0.43	Per 160-char segment; Arabic unicode halves the segment length
SMS, e& / du international	—	AED 0.50–1.00	Operator retail rate; volume commitments cut up to 50%
WhatsApp authentication template	USD 0.0157	AED 0.058	Meta rate effective 1 Oct 2026; billed per delivered message only
WhatsApp authentication-international	USD 0.051	AED 0.187	Applies to eligible senders under Meta's own rules
Verification API fee (e.g. Twilio Verify)	USD 0.05	AED 0.18	Per successful verification, on top of the message cost
Passkey / FIDO2 login	USD 0	AED 0	No message at all; build cost only

Read the first and third rows together. A WhatsApp authentication template to a UAE number costs about one seventh of an SMS segment, and Meta does not bill undelivered messages. Moving your returning-user flow to WhatsApp does not stop pumping on its own — a bot can still trigger sends — but it cuts the attacker's payout per request by roughly 86%, which is often enough to make your app an unattractive target. Our UAE messaging cost breakdown covers the TDRA sender ID and template-approval mechanics before you switch.

Six controls that actually stop it

Ranked by how much fraud they remove per hour of engineering. None of them require a new vendor.

1. Allowlist destinations, do not blocklist them

This is the single highest-value change and it is usually a config flag. If you serve the UAE and the GCC, accept +971, +966, +965, +973, +968, +974 and the handful of expat markets your real users actually come from, and reject everything else at the API boundary. Blocklisting is a losing game: there are around 200 country codes and the attacker only needs one you forgot. Twilio exposes this as geo-permissions; most providers have an equivalent.

2. Cap per number and per IP, with backoff

A single phone number requesting more than three to five codes in a short window is almost never legitimate. Hard-cap at five per number per hour with exponential backoff on repeated failures. Separately, cap unique destination numbers per IP per hour — one IP fanning out across hundreds of numbers is the clearest pumping signature there is, and it is invisible to a per-number limit.

3. Alert on conversion rate, not on volume

Volume alerts fire during legitimate campaigns and get muted. Instead alert when codes-sent-to-codes-entered drops below your normal baseline for 30 minutes. Pair it with a hard daily spend ceiling at your provider. The point is to cap the loss at a few hundred dirhams rather than discover it on an invoice three weeks later.

4. Put a friction layer in front of the send

An invisible CAPTCHA (reCAPTCHA Enterprise, Turnstile, hCaptcha) plus platform device attestation — Play Integrity on Android, App Attest on iOS — stops the cheap end of the market outright. It will not stop a determined farm using real devices, which is why it is fourth on this list rather than first.

5. Turn on your provider's pumping protection

Twilio reports that Verify Fraud Guard has blocked over 569 million fraud attempts and saved customers more than USD 62.7 million, and it is included in the USD 0.05 per-successful-verification fee rather than priced separately. One beta customer published a 27% increase in SMS conversion rate, a 42% decrease in cost per user, and over USD 300,000 saved in the first month. Those are vendor-reported figures, but the direction is right and the switch costs nothing to flip.

6. Remove the message from the happy path

The only verification that cannot be pumped is the one you never send. Use SMS once, at first registration, then issue a long-lived device token or a passkey so returning users never trigger another message. Most apps send 80% of their OTP volume to users who have already proved who they are. Our passkeys and WebAuthn guide for Dubai covers the implementation path.

The UAE caveat: silent network authentication is not an option yet

Everywhere else, the clean answer is the GSMA Open Gateway Number Verification API — the network confirms the handset's own number, no message sent, nothing to pump. It is the second most widely deployed Open Gateway API globally.

In the UAE it is not yet on the menu. When e& UAE announced three CAMARA certifications on 25 August 2025, they were SIM Swap, Carrier Billing and Device Status. Number Verification was not among them. So plan your architecture on the assumption that silent network auth arrives later, and in the meantime use the SIM Swap API for what it is genuinely good at: checking whether a number was recently ported before you trust a code sent to it.

The regulator has already drawn its own conclusion about SMS codes. CBUAE Notice 2025/3057 required licensed financial institutions to retire SMS and email one-time passwords by 31 March 2026, with penalties for significant violations reaching AED 250,000. You may not be a licensed institution, but your enterprise clients' procurement teams now ask the question, and your checkout sits downstream of banks that have already switched. The related risk on the payments side is covered in our chargeback and fraud defence guide.

What this costs to fix in Dubai

Real ranges for the work, not a consulting day rate:

• AED 4,000–9,000 — emergency hardening on an existing app: destination allowlist, rate limits, spend ceiling, conversion-rate alerting. Two to four days. This is the call to make if your bill is climbing right now.
• AED 12,000–30,000 — the full verification rebuild: WhatsApp authentication templates with SMS fallback, device attestation, trusted-device tokens, a cost-per-verified-user dashboard in AED, and TDRA sender ID registration handled with both e& and du.
• AED 25,000–60,000 — passwordless migration with passkeys for returning users, which removes most message volume permanently and answers the CBUAE-adjacent procurement question in writing.

Set that against the arithmetic above. The mid-range rebuild costs less than one and a half days of an unmetered pumping attack at AED 0.43 a segment — and unlike the attack, it keeps paying: the WhatsApp channel shift alone typically cuts steady-state verification spend by well over half for a UAE consumer app.

Aquarius builds and audits these flows for Dubai businesses. You get the allowlist and throttle configuration in your own provider account, the alerting wired to your own channel, the cost dashboard in AED, and full source handover — no retainer required to keep it running. See transparent AED pricing, or send us one month of your messaging invoice and we will tell you free whether the spike is growth or fraud.

FAQ

How do I know for certain that I am being pumped?

Pull your last 90 days of verification logs and compute two ratios per destination country code: codes sent versus codes successfully entered, and sends per unique number. Legitimate traffic sits at roughly 80% completion with 1.1 to 1.3 sends per number. Any country code showing near-zero completion, or any IP fanning out across dozens of unrelated numbers, is fraud. You do not need a tool for this — it is one SQL query against your own data.

Will my messaging provider refund fraudulent sends?

Assume not. The messages were genuinely delivered and the termination fees were genuinely paid downstream, so the standard answer is that the traffic is your responsibility. Some providers offer goodwill credit on a first incident if you can demonstrate the attack and then adopt their protection features. Negotiate from a position of having already fixed the hole.

Is WhatsApp OTP immune to pumping?

No, but the economics change in your favour. A bot can still trigger a WhatsApp authentication template, and at AED 0.058 per delivered message you can still be drained. The differences are that Meta bills only delivered messages, the per-message payout to any colluding party is far smaller, and WhatsApp requires the destination to be an active account on the platform — which rules out most bulk-acquired fraud ranges. It is a strong mitigation, not a cure. Keep the allowlist and the rate limits.

Does blocking countries hurt my real users?

Measure before you assume. For a Dubai-serving app the honest answer is almost always no: the destinations that appear in pumping attacks have essentially no overlap with UAE residents, tourists or GCC customers. Start the allowlist from your last twelve months of verified users rather than your last twelve months of send attempts, then add any legitimate market a sales lead actually names.

We are a B2B SaaS, not a consumer app. Are we still exposed?

Yes, anywhere an unauthenticated visitor can cause a message to be sent. The usual culprits are trial signups, phone-verified demo requests, and “text me a download link” widgets. Low volumes mean a smaller bill, but they also mean nobody is watching the graph — B2B teams tend to find out at the quarterly budget review rather than in week one.

How fast can this be shut down once it starts?

The destination allowlist and the per-IP cap are both configuration changes and can be live inside an hour. The spend ceiling is immediate. Everything else — attestation, channel migration, passkeys — is a project you schedule afterwards. Stop the bleeding first, then rebuild the flow properly.