To stop OTP abuse, limit requests per number and per device, enforce a wait between codes, send only to the countries your customers are in, and alert yourself when daily messaging spend passes a threshold. To stop fake sign-ups, tie offers and coupons to a verified phone number and device. To stop order fraud, use 3D Secure through your payment gateway, confirm first or large cash-on-delivery orders over WhatsApp, and review unusual patterns weekly.
- how to prevent fake sign ups
- sms pumping fraud otp
- otp costs suddenly increased
- how to stop fake cash on delivery orders
- how to prevent coupon abuse
Three different problems that cost you money
When app owners talk about fake sign-ups, OTP abuse and order fraud, they often mix up three different problems, each with its own fix:
| Problem | What happens | Who pays | First sign |
|---|---|---|---|
| SMS pumping (OTP abuse) | Bots request thousands of codes to expensive international numbers | You, through your messaging bill | A jump in SMS costs and requests to countries you do not sell in |
| Fake sign-ups | One person creates many accounts to exploit a welcome coupon or referrals | Your margin | Many first-order coupons to the same address or device |
| Order fraud | Stolen cards, or cash-on-delivery orders nobody accepts | Your stock, shipping costs and chargebacks | Repeat delivery refusals or payment disputes |
The good news is that the core protections for each are simple and can be requested from the agent in conversation. The real challenge is balance: strong enough to stop the fraudster, light enough not to drive away the customer ordering from her phone after iftar.
Make fraud expensive for the fraudster, and invisible to the genuine customer.
What is SMS pumping, and why did your bill jump?
In this kind of fraud, the attacker does not care about your customers' accounts at all. They use your sign-up form to send SMS messages to international numbers whose revenue they share with parties in the telecom chain. Every message your app sends costs you; they profit from the volume. The result: a messaging bill that multiplies overnight with no new customers.
Signs you are being targeted
- Many code requests to numbers in countries you neither sell nor ship to.
- Sequential or very similar numbers requesting codes minutes apart.
- Lots of codes sent but almost none entered, so verification completion is very low.
- Requests at odd hours in a regular, machine-like rhythm.
- A sudden jump in messaging cost with no matching rise in orders.
OTP protections every app should have
If your app uses phone-number (OTP) login, these protections should be on before launch:
- Country allowlist: if your customers are in Saudi Arabia, the UAE and the GCC, allow numbers from those countries only, and open others when there is a real need.
- Wait between codes: about a minute before a resend is allowed, growing with each attempt.
- Per-number limits: a capped number of codes per number per hour and per day.
- Per-device and per-network limits: so one device cannot request codes for hundreds of numbers.
- Short expiry, single use: codes expire within minutes and are cancelled after use or after a few wrong attempts.
- Extra check only when suspicious: a simple human-vs-bot challenge that appears only on a suspicious pattern, not for every user.
- Budget alert: a message to you when messaging spend passes a daily threshold, with automatic pausing of non-core countries.
Fake sign-ups, coupon abuse and referral abuse
A first-order discount or an invite-a-friend credit is a great growth tool and a favorite abuse target. One person signs up with ten numbers to grab ten discounts, or refers themselves repeatedly.
- Tie the first-order coupon to a verified phone number, not an email that takes seconds to create.
- Check for repeated delivery addresses, devices and payment methods: ten new accounts at one address is a clear signal.
- Grant referral rewards only after the friend completes a paid, delivered order, not at sign-up.
- Cap rewards per account per month.
- For high-value services such as equipment or chalet rentals with large amounts, consider identity verification through Nafath in Saudi Arabia or UAE PASS in the UAE.
Do not turn protection into collective punishment. One family may order from one address with three accounts, and that is normal. The rule: review suspicious cases by hand rather than auto-rejecting them, at least at the start.
Order fraud: cards and cash on delivery
- Enable 3D Secure through your payment gateway
- Use your gateway's risk-scoring tools
- Watch for large orders from new accounts with several declined cards
- Never ship before the gateway confirms to your server
- Answer disputes quickly with evidence: proof of delivery and chat history
- Confirm first or large orders by WhatsApp before shipping
- Cap order value for new accounts
- Ask for a deposit or online payment on large orders
- Flag accounts after repeated delivery refusals
- A clear National Address reduces undeliverable orders
Cash on delivery still matters to a segment of Gulf customers, and dropping it can cost sales. The smarter move is usually to offer it with conditions and nudge online payment with a small perk, such as faster shipping. For the full comparison, read cash on delivery vs online payment in Saudi Arabia, and for disputes, refunds and chargebacks in the Gulf.
Build the protections with the agent
- 1Start with OTP limits
They are the cheapest and fastest win. Turn them on before any launch or ad campaign.
- 2Add alerts
A daily budget alert and an alert for low verification completion.
- 3Tie offers to verified numbers
Update coupon and referral logic before launching any welcome offer.
- 4Set cash-on-delivery rules
WhatsApp confirmation for first orders, a value cap and a flag for repeat refusals.
- 5Review weekly
An admin page listing suspicious cases for you to decide by hand.
Add fraud protection to the app: (1) Send OTP codes only to numbers in Saudi Arabia, the UAE and the GCC, with a 60-second wait before resend that doubles on each attempt, a limit of 5 codes per number per day, a per-device limit, 5-minute expiry, and cancel the code after 3 wrong attempts. (2) Alert me on WhatsApp and email if OTP messages pass a daily limit I set in settings, and automatically pause sending to non-core countries. (3) The first-order coupon works once per verified phone number and per delivery address. (4) Cash on delivery is available to new accounts up to an amount I set, a WhatsApp confirmation is sent before shipping, and the account is flagged after two refused deliveries. (5) A Suspicious cases page in the admin panel, owner only. Show me the plan before building.
Try it in FanannBalancing protection and customer experience
The worst protection system stops the fraudster and the customer alike. Make protection escalate with risk: nothing extra for a normal customer, a light check on a suspicious pattern, and manual review only for big cases.
| Risk level | Example | Suggested response |
|---|---|---|
| Low | A returning customer with a typical order | Nothing; a completely smooth experience |
| Medium | A new account with an unusually large cash-on-delivery order | WhatsApp confirmation before shipping |
| High | Rapid code requests to international numbers, or several declined cards | Temporary block plus extra verification or manual review |
Review your numbers before peak seasons; fraudsters know Ramadan and White Friday mean a stretched team and generous discounts. These items are part of the broader security checklist for AI-built apps.
Key takeaways
- SMS pumping is financial fraud aimed at your messaging bill, not at your customers' accounts.
- Core protection: per-number and per-device limits, waits between codes, a country allowlist and a budget alert.
- Tie coupons and referrals to a verified phone number and device, not just an account.
- Cash on delivery needs rules: WhatsApp confirmation, limits for new accounts, and handling repeat refusals.
- Escalate protection with risk so you never punish genuine customers.
Frequently asked questions
Why did my OTP SMS costs suddenly increase?
How do I prevent fake sign-ups in my app?
How do I stop fake cash-on-delivery orders?
Does 3D Secure protect me from card fraud?
Will fraud protection annoy real customers?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “Stop fake sign-ups, OTP abuse and order fraud” https://fanann.com/en/blog/prevent-fraud-otp-abuse/ My question: how to prevent fake sign ups Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.