A 30-cent text message can bankrupt a business model.
Some of the costliest fraud never touches a single consumer. Arkose Labs founder and CEO Kevin Gosschalk breaks down SMS toll fraud, an attack exploiting premium-rate phone numbers and OTP verification texts that quietly drains tens of millions of dollars from platforms every year.
About the speaker
There's this one attack that it costs companies we work with tens of millions of dollars, like to the point where they're not profitable in certain countries they operate in because of this attack vector.
So bad actors get access to millions of premium phone numbers and then they use a bot and they go through. And they sign up for millions of accounts and they make 3 to 6 cents every time you send 'em an OTP message.
It's not a type of fraud that hits consumers 'cause it's attacking the platform itself. So consumers don't even aware that it's probably happening.
I think agentic technology will resurface things that aren't profitable fraud schemes right now 'cause you have to have a human loop to do it or something's expensive about it. And now can do it scale and the cost just plummeted.
There's an incredible amount of ways of making money by doing bad things on the internet, unfortunately. There's this one attack that costs companies we work with tens of millions of dollars, to the point where they're not profitable in certain countries they operate in because of this attack vector. When you sign up to a website, sometimes they ask you to put a phone number in, to text you a verification code as part of the signup flow, or when you're logging in, they might text you — like two-factor authentication.
Turns out in a lot of countries in the world, like Egypt, Ukraine, and many places in Europe, the cost to send that text message is pretty expensive — it could cost up to 30 cents to text someone in Egypt or Vietnam. It's 29 cents to send a text message with that OTP code to them. So bad actors get access to millions of premium phone numbers, then they use a bot and sign up for millions of accounts, and they make 3 to 6 cents every time you send them an OTP message. Companies are losing tens of millions of dollars to this.
It's not a type of fraud that hits consumers, because it's attacking the platform itself, so consumers aren't even aware it's probably happening. I think agentic technology will resurface things that aren't profitable fraud schemes right now, because you have to have a human in the loop to do it, or something's expensive about it. Now it can be done at scale and the cost just plummeted. So we're going to see a reinvention of what was old fraud — it's most likely going to come back with an agentic flavor on it.
Stopping bots, AI agents, and fraud before they reach your users.
