SMS bombing is the flooding of a phone number with a large number of text messages, usually by abusing website or app features that send verification codes. The goal can be to harass the owner, hide a real alert among the noise, or pressure a person into sharing a login code. It can also cost the company that sends the messages.
- Also Called2other namesSMS bomber · OTP bombing
- Related Terms3linked entriesMFA fatigue · Smishing · Account takeover
- Read Next1guide on the same topicDigital Risk Protection 101
How does SMS bombing work?
Many sites and apps send a one-time code by text when someone signs up, signs in or resets a password. If that feature has no limit on how often it can be used, a script can call it again and again with the same phone number. The victim’s phone then receives a stream of codes. Free online tools make this easy to do.
Why does it matter?
For the person, it is a nuisance that can hide real messages. It can also be used alongside an attempt to take over an account, because a flood of codes may confuse or tire the person (see MFA fatigue). For the company that owns the sign-up or reset feature, every message can cost money, and customers may blame the company.
The OWASP API Security Top 10 notes that operations paid for per request, such as sending SMS or phone calls, make this kind of abuse costly for the owner of the API.
How do you defend against it?
OWASP recommends limiting how often a single client or user can run an operation such as OTP validation or password recovery. In practice, teams usually:
- Cap how many codes one phone number can receive in a given period.
- Add checks such as CAPTCHA before sending a code.
- Monitor message volume and alert on sudden spikes.
People who are targeted should never share a code or approve a request they did not start, and should tell their mobile operator and the company concerned. See also smishing, which is a different attack: fraudulent texts meant to trick the reader.
Related pages in the Knowledge Hub
Also Called.
- NameSMS bomber
- NameOTP bombing
Questions.
-
What is SMS bombing?
It is the flooding of a phone number with text messages, usually by repeatedly triggering a service that sends verification codes.
-
Is SMS bombing the same as smishing?
No. Smishing is a fraudulent text meant to trick the reader. SMS bombing is a flood of messages, often real verification codes.
-
How can a company prevent SMS bombing?
OWASP advises limiting how often a client can run operations such as OTP validation or password recovery. Capping codes per phone number is a common step.
Sources
In Our Research
- 1 MFA fatigue Glossary term
- 2 Smishing Glossary term