{
  "id": "OPS-156",
  "slug": "ops-156",
  "title": "Watch for traffic that is being pumped",
  "statement": "Content and traffic patterns consistent with artificially inflated traffic must be detected and rejected.",
  "rationale": "Artificially inflated traffic is fraud committed through your account rather than by you: an attacker drives OTP or verification sends to number ranges that pay them a share of the termination fee, and the bill is yours. The signature is a destination distribution that does not look like your customers — sudden concentration in unusual ranges or countries — and it costs real money for as long as nobody is watching.",
  "layer": "OPERATIONAL",
  "layerSlug": "operational",
  "object": "traffic pattern and destination distribution",
  "severity": "HIGH",
  "detectability": [
    "UNDETECTABLE_PRE_SUBMISSION"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "Twilio",
    "Telnyx"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Rate-limit verification and OTP endpoints per source, alarm on shifts in destination distribution, and cap spend per hour so a pumping attack is bounded. Done when an unexpected concentration of destinations pages somebody within the hour.",
  "pitfalls": [
    "A CAPTCHA on the form does not stop this — the attack drives the API behind it, so the control has to sit at the send."
  ],
  "notes": "A pattern in live traffic. What the user has to do is put a spend cap and a distribution alarm on any endpoint a stranger can trigger, because the exposure is unbounded until one exists.",
  "phase": "post",
  "automated": false,
  "attestation": {
    "question": "Is there a spend cap and a destination-distribution alarm on every endpoint a stranger can trigger?",
    "howToCheck": [
      "List the endpoints that send without a logged-in user — verification and OTP are the usual ones.",
      "Rate-limit per source, cap spend per hour, and alarm on shifts in destination distribution.",
      "A CAPTCHA on the form does not stop this: the attack drives the API behind it, so the control has to sit at the send."
    ],
    "failureLooksLike": "An attacker drives OTP sends to number ranges that pay them a share of the termination fee. It is fraud committed through your account rather than by you, the bill is yours, and the exposure is unbounded until a cap exists."
  },
  "url": "https://ekas.io/rules/10dlc/operational/ops-156/",
  "markdown": "https://ekas.io/rules/10dlc/operational/ops-156.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}