Phone verification without outbound SMS: how to stop SMS pumping

Who uses iMessage for phone verification?

Inbound iMessage verification is for growth and security engineers who pay per verification, or whose signup form has been scripted to send codes to numbers nobody uses. ZeroSettle is an iMessage API: a real phone number on real iMessage, running on Apple hardware we operate for you, that your code texts customers from and hears back on through a bearer token and signed webhooks.

An SMS code is billed per message sent, whether or not anyone finishes verifying. Twilio's glossary describes the abuse: "SMS pumping fraud happens when fraudsters take advantage of a phone number input field" to have codes sent to a range of numbers controlled by one mobile network operator, and "the fraudsters get a share of the generated revenue." The sign Twilio tells you to look for is a spike of messages to a block of adjacent numbers with no completed verifications. The approach below fits apps whose signups mostly come from iPhone, iPad or Mac. For login on the same mechanism, see Sign in with iMessage; more workflows are in the use-case index.

How iMessage phone verification works, step by step

The user proves the number by sending a code to you, instead of you sending a code to the number, so the verify endpoint has no outbound step for an attacker to trigger.

1. Your backend creates an attempt: a random 6-character code, a 10-minute expiry, tied to the signup session. Rate-limit this call per IP and per device. It sends nothing.
2. A Verify with iMessage button opens sms:+18055550100&body=VERIFY%207KD2PA: Messages opens addressed to your number with the code filled in, and the user taps Send. Desktops without Messages get the link as a QR code.
3. About 1–2 seconds after the line receives the text, ZeroSettle POSTs a signed message.received event to your webhook, carrying text and handle, the address Apple attached to the message.
4. Your webhook verifies the signature, accepts the code once and only before it expires, and stores handle as the verified number. Every other inbound text is ignored and gets no reply.
5. Optionally, POST /api/imessage/reactions puts a 👍 on the user's message: the only thing your number sends, and only to a handle that has just proved itself.
6. The signup screen polls your status endpoint and continues. If the attempt expires, it offers your existing SMS code.

Assumes no filter catches the attack. Twilio Verify includes Fraud Guard, which blocks SMS it judges likely fraudulent, so a real bill can be lower. Twilio prices SMS per destination country; this uses its US rate as one example.

Example conversation: phone verification

The whole verification thread is one text from the user and, optionally, one tapback from your number, shown here from the side of Acme Budget, a fictional budgeting app.

Setup: inbound verification with rate limits

Setup is a small service that creates rate-limited attempts and accepts each code once, registered with PUT /api/imessage/webhook (store the returned secret, shown once, as ZEROSETTLE_WEBHOOK_SECRET). It adapts the backend in the docs' Sign in with iMessage section, with the signature check copied from Webhooks, step by step.

# verify_phone.py: run with  uvicorn verify_phone:app --port 8100
import hashlib, hmac, json, os, re, secrets, time
from collections import defaultdict, deque
import httpx
from fastapi import BackgroundTasks, FastAPI, HTTPException, Request, Response

app = FastAPI()
BASE = os.environ.get("ZEROSETTLE_BASE_URL", "https://portal.zerosettle.io")
TOKEN, SECRET = os.environ["ZEROSETTLE_TOKEN"], os.environ["ZEROSETTLE_WEBHOOK_SECRET"]
ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"     # no 0/O/1/I
attempts, by_code = {}, {}                         # use Redis in production
hits = defaultdict(deque)

def allow(key, limit=5, window=600):
    q, now = hits[key], time.time()
    while q and q[0] < now - window:
        q.popleft()
    q.append(now)
    return len(q) <= limit

def verify(secret: str, header: str, raw_body: bytes, tolerance: int = 300) -> bool:
    try:
        parts = dict(p.split("=", 1) for p in header.split(","))
        t, v1 = int(parts["t"]), parts["v1"]
    except Exception:
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

@app.post("/verify/start")
def start(req: Request):
    device = req.headers.get("X-Device-Id")        # your app's install id
    ip = req.client.host                           # behind a proxy, run uvicorn with --forwarded-allow-ips
    if not allow("ip:" + ip) or (device and not allow("dev:" + device)):
        raise HTTPException(429)
    aid, code = secrets.token_urlsafe(16), "".join(secrets.choice(ALPHABET) for _ in range(6))
    account = current_signup(req)                  # your signup session
    attempts[aid] = {"exp": time.time() + 600, "state": "pending", "account": account}
    by_code[code] = aid
    return {"id": aid, "code": code}

@app.post("/webhook")
async def webhook(req: Request, tasks: BackgroundTasks):
    raw = await req.body()
    if not verify(SECRET, req.headers.get("X-ZeroSettle-Signature", ""), raw):
        return Response(status_code=401)
    ev = json.loads(raw)
    if ev["event"] != "message.received":
        return {"ok": True}
    m = ev["message"]
    match = re.search(r"\bVERIFY\s+([A-Z2-9]{6})\b", (m.get("text") or "").upper())
    a = attempts.get(by_code.pop(match.group(1), None)) if match else None
    if not a or a["state"] != "pending" or a["exp"] < time.time():
        return {"ok": True}                        # junk, expired or reused: no reply
    if not m["handle"].startswith("+"):
        a["state"] = "no_phone_number"             # email handle: offer your SMS code
        return {"ok": True}
    a.update(state="verified", handle=m["handle"])
    mark_phone_verified(a["account"], m["handle"])  # your database
    tasks.add_task(like, m["id"])                  # optional 👍, after the 2xx
    return {"ok": True}

async def like(message_id):
    async with httpx.AsyncClient() as c:
        await c.post(f"{BASE}/api/imessage/reactions", headers={"Authorization": f"Bearer {TOKEN}"},
                     json={"message_id": message_id, "reaction": "like"}, timeout=90)

@app.get("/verify/status")
def status(id: str):
    a = attempts.get(id) or {"state": "unknown"}
    if a["state"] == "pending" and a["exp"] < time.time():
        a["state"] = "expired"
    return {"state": a["state"], "phone": a.get("handle")}

Three details are specific to verification. by_code.pop consumes each code, so a reused code or a webhook retry is ignored. The 👍 runs after the webhook answers, because ZeroSettle expects a 2xx within 10 seconds. And the line must stay Managed by API: on a line the hosted AI agent manages, inbound texts are not POSTed to your webhook, and the agent would answer the code itself. More on webhook signing and retries and ZeroSettle's API security.

Limits and consent for phone verification

Phone verification is inbound only, so it carries no new-contact cost and no per-message fee on the flat plan. ZeroSettle's new-contact limit (5 a day per number on Pro, 50 on Growth) counts only handles the line messages first, and anyone who texted the line first is never limited.

Verification sends nothing to anyone who has not just texted you, so there is no outreach to collect consent for. A verified number is generally not consent for anything else: the docs' compliance rules say a person must give you their number for the purpose you text them about, so plan on a separate opt-in before marketing to it. Rules vary by country and use; this isn't legal advice, so check with counsel. A user who once texted STOP can still verify, but the 👍 to them is refused with 403 recipient_opted_out, so the code treats it as optional.

When ZeroSettle is not a fit for phone verification

ZeroSettle is the wrong verification channel in these cases:

• Most users are on Android. There is no SMS fallback, so they stay on outbound OTP and the pumping exposure stays with them. See iMessage vs SMS vs RCS vs WhatsApp.
• You need verification by voice call. ZeroSettle carries iMessages, not calls.
• A regulator or partner requires a specific OTP vendor. The contract decides, not the cost.
• You can't change signup to a "tap Send" step. The user has to leave your form for Messages and come back.
• Every account must have a phone number. From an iMessage-only device, such as an iPad with no number, the handle is an email address.
• Signup needs a contractual SLA. ZeroSettle shows "99.9% uptime" on its homepage but publishes no SLA, so keep the expiry fallback.

How much does iMessage phone verification cost?

Inbound phone verification costs the ZeroSettle plan price and nothing per message: messages are unlimited (counted) on both plans.

Compare against your provider's published per-verification price. As of October 2026, per its public pricing page, Twilio Verify lists "$0.05 per successful verification + $0.0083 per SMS (US)" and charges the SMS fee on every attempt, so $49 a month equals about 840 completed US verifications, and each pumped attempt that Fraud Guard misses still costs its SMS fee. Per Twilio's US SMS pricing page, sending your own codes through its standard US SMS costs $0.0083 per 160-character segment plus a carrier fee ($0.005 to Verizon on a long code) and $0.001 per failed message. Your Android fallback keeps part of that bill. See ZeroSettle vs Twilio and ZeroSettle's pricing, then get a number or read the API docs.