Mobile-Originated iMessage 2FA Could Eliminate SMS Pumping Fraud and Cut Costs

SMS pumping, also known as Artificially Inflated Traffic fraud, is a scheme where bad actors submit thousands of phone numbers to a company's verification endpoint, triggering paid SMS codes that generate revenue for fraudsters through carrier termination fees. The scam exploits the fact that companies pay for every outgoing one-time password, creating a direct financial incentive for abuse at scale. Elon Musk cited this fraud as costing Twitter approximately $60 million per year before the platform removed free SMS two-factor authentication, with around 390 telecom operators allegedly implicated. A proposed alternative flips the model: instead of companies sending codes to users, users send a pre-filled one-time code from their own iMessage to the service, eliminating any outbound per-message cost that fraudsters could exploit. Because the message originates from the user's Apple ID over end-to-end-encrypted iMessage, the approach is also more resistant to spoofing than traditional SMS-based verification.