SMS bombing is the flooding of a phone number with a large number of text messages, usually by abusing website or app features that send verification codes. The goal can be to harass the owner, hide a real alert among the noise, or pressure a person into sharing a login code. It can also cost the company that sends the messages.
- Also Called2other namesSMS bomber · OTP bombing
- Related Terms3linked entriesMFA fatigue · Smishing · Account takeover
- Read Next1guide on the same topicDigital Risk Protection 101
How Does a Text Flood Start?
Many sites and apps send a one-time code by text when someone signs up, signs in or resets a password. If that feature has no limit on how often it can be used, a script can call it again and again with the same phone number. The victim’s phone then receives a stream of codes. Free online tools make this easy to do.
What Does One Abused Reset Form Set Off?
OWASP gives this pattern as an example scenario in its API Security Top 10. A forgot password page sends a code by text, and each code costs the company a fee. The steps below show how one request becomes a flood.
- Someone taps forgot passwordThe browser sends one request with a phone number to the service API.
- The service calls an SMS providerThe back end asks the provider to send one code, and the provider charges for each call.
- A script repeats the first requestIn the OWASP example, the script sends it tens of thousands of times.
- Texts and costs pile upOne text goes out per call, and the company can lose thousands of dollars within minutes.
Who Loses When the Texts Pile Up?
For the person, it is a nuisance that can hide real messages. It can also be used alongside an attempt to take over an account, because a flood of codes may confuse or tire the person (see MFA fatigue). For the company that owns the sign-up or reset feature, every message can cost money, and customers may blame the company.
The OWASP API Security Top 10 makes the same point. Operations paid per request, such as SMS or phone calls, make this abuse costly for the API owner.
How Can a Company Stop the Flood?
OWASP recommends limiting how often a single client or user can run an operation such as OTP validation or password recovery. In practice, teams usually:
- Cap how many codes one phone number can receive in a given period.
- Add checks such as CAPTCHA before sending a code.
- Monitor message volume and alert on sudden spikes.
- Set a spending limit with the SMS provider, or a billing alert if limits are not possible.
People who are targeted should never share a code or approve a request they did not start, and should tell their mobile operator and the company concerned. See also smishing, which is a different attack: fraudulent texts meant to trick the reader.
Related Pages in the Knowledge Hub
Also Called.
- NameSMS bomber
- NameOTP bombing
Questions.
-
What is SMS bombing?
It is the flooding of a phone number with text messages, usually by repeatedly triggering a service that sends verification codes.
-
Is SMS bombing the same as smishing?
No. Smishing is a fraudulent text meant to trick the reader. SMS bombing is a flood of messages, often real verification codes.
-
How can a company prevent SMS bombing?
OWASP advises limiting how often a client can run operations such as OTP validation or password recovery. Capping codes per phone number is a common step.
Sources
In Our Research
- 1 MFA fatigue Glossary term
- 2 Smishing Glossary term