Eliminate SMS verification abuse

Use a mix of bot detection and velocity signals to lock down spammy SMS fees with high precision.

Real-time blocking

Rules execute in milliseconds to block SMS pumping inline without noticeable delay.

Custom definitions

Define SMS pumping your way using advanced filtering and real-time velocity queries.

Granular analytics

Leverage BI-grade analytics to expose SMS pumping and fraud rings at scale.

Data enrichment

Enriched with device intelligence, risk scores, velocity metrics, and much more.

Define SMS pumping using custom logic

Castle lets you use advanced filtering, real-time velocity queries, and custom lists to segment out SMS pumping with high precision.

• deny
• Abuse Score is > 60
• and Phone Number Country is not United States
• and Count of events SMS Verification by Device Fingerprint in the last 1 hour is > 5
• or Signals include Banned Phone Number

Action on SMS pumping in real-time

Rules execute in milliseconds and can be used to adapt the user experience based on risk in real-time.

• deny
• Abuse Score is > 90
• and Disposable Email is true
• and Count events Registration by Device Fingerprint in the last day is > 3
• or Signals include Blocked country
• Add User ID Warned Account Sharers
• Remove User ID Allowed Users
• Send webhook https://hooks.zapier.com/hooks/catch/4378238094/ch3dka
• Send to Slack #security-alerts

Real-time decisions

Assessments of data like user count per device or hourly failed logins executed in the blink of an eye.

Inline blocking

Initiate request blocks or step-up verifications anywhere in your app without disrupting the user experience.

Alerts & notifications

Ensure your team and users stay informed with triggered Slack notifications or webhooks.

A holistic view of SMS pumping

Harness the power of BI-grade analytics to expose SMS pumping attacks and unravel fraud rings with precision.

Event Data

1. Timestamp: Sat, Aug 8 07:59:08
   Policy: Challenge
   Event: Registration Attempted
   User: kevin.qfanjul@gmail.com
   Location: Spain 33204, Gijón
   Device: Chrome on Windows 10
   Signals: Disposable email domains, New device

2. Timestamp: Sat, Aug 8 07:59:08
   Policy: Deny
   Event: Registration Attempted
   User: oleg.kalinovskiy75@gmail.com
   Location: Ukraine 29000, Khmelnytskyi
   Device: Chrome on Windows 10
   Signals: Trusted user devices

3. Timestamp: Sat, Aug 8 07:59:08
   Policy: Deny
   Event: Login Attempted
   User: themba.ndlovu@gmail.com
   Location: South Africa 8001, Cape Town
   Device: Chrome on Windows 10
   Signals: Challenged IPs, Timezone Area Mismatch, Multiple Accounts Per Device

4. Timestamp: Sat, Aug 8 07:59:08
   Policy: Deny
   Event: Password Reset
   User: priya.sharma@gmail.com
   Location: India 400001, Mumbai
   Device: Chrome on Windows 10
   Signals: Multiple Accounts Per Device

5. Timestamp: Sat, Aug 8 07:59:08
   Policy: Challenge
   Event: Challenge Succeeded
   User: anton.volkov.2023@gmail.com
   Location: Russian Federation 672000, Chita
   Device: Chrome on Windows 10
   Signals: Disposable email domains, Multiple Accounts Per Device

Enrichment

Every interaction is enriched with comprehensive device intelligence, risk scores, location data, and much more.