Humanizing text messaging at any scale

SMS Fraud You Don’t See Coming: What Sales & Marketing Teams Need To Know

Written by Vivek Zaveri | Nov 11, 2025 3:14:25 PM

You followed every rule. You included opt-out instructions. You only texted people who filled out a form. So why are you suddenly being accused of violating the TCPA?

Welcome to the dark side of SMS.

In 2024 alone, TCPA class actions increased over 95% year-over-year. And SMS fraud—including traffic pumping scams—cost businesses over $1.16 billion globally. The common denominator? These aren’t issues with your message. They’re problems with who you’re messaging.

This post explains the hidden risks of texting: from TCPA landmines to carrier scams to bad data in your CRM—and how to protect yourself.

The Serial Plaintiff Problem

The TCPA (Telephone Consumer Protection Act) allows consumers to sue businesses for unwanted texts or calls. Fines start at $500 per violation and can go up to $1,500 per text if the violation is considered willful.

And some people have figured out how to make a business out of it.

One man in Texas filed more than 60 TCPA lawsuits in a single year. In another case, a plaintiff intentionally submitted fake quote requests just to catch insurers in TCPA violations and sue.

These serial plaintiffs may look like regular leads. They fill out forms. They act interested. Then they wait for you to break a rule—like texting without proper consent or missing an opt-out—and strike.

These cases aren’t just annoying. They’re expensive. A single TCPA class action can cost $6 million to settle. Even individual claims often settle for $5,000–$20,000.

And if you’ve been sued once? You’re now on the radar. Other firms watch TCPA filings to find new targets.

How ‘Toxic’ Leads Create Challenges

Most marketers think about lead quality in terms of conversions. But a single “toxic” contact can sink your ROI—and your legal budget.

The real risk comes from believing a lead is safe just because they filled out a form.

Here's what trips companies up:

  • Consent that’s too broad: Many lead sellers claim leads are “TCPA compliant” because users clicked “I agree” on a vague form. But courts now expect one-to-one consent—not a blanket opt-in for dozens of partners.

  • Recycled phone numbers: A user may have opted in—but now the number belongs to someone else. That new person never gave consent. There’s an FCC tool for this called the Reassigned Numbers Database, but few marketers use it.

  • VoIP or virtual numbers: These can be spoofed or used in fraud schemes. Some plaintiffs use them intentionally because they’re easier to trace.

Texting the wrong number—even with a polite message and opt-out instructions—can still result in legal action.

The SMS Pumping Scam

Here’s another threat you probably haven’t seen coming: SMS pumping.

This scam works like this:

  1. A fraudster sets up a fake website or form to trigger one-time password (OTP) messages.
  2. They use a SIM farm or collude with a shady telecom carrier to receive the messages.
  3. Every message sent incurs a fee—for you, not them.

According to the Mobile Ecosystem Forum, SMS pumping scams account for 5% of all international A2P (application-to-person) traffic and cost companies hundreds of millions per year.

Even Elon Musk admitted Twitter/X was losing over $60 million a year to these scams.

“One fake lead. Hundreds in SMS fees. Overnight.”

It’s easy to miss until your CFO sees the carrier bill. These attacks often involve:

  • OTP requests from unusual countries
  • Traffic to sequential phone numbers (e.g., +251-123-0001, 0002…)
  • Sudden spikes in send volume

And unlike spam complaints, these fraudsters don’t file lawsuits. They just siphon money until you notice.

Compliance Isn’t Just a Checkbox

A lot of marketing teams think: “We’re safe. We include opt-outs and don’t send at night.”

That’s not enough.

You need to know:

  • Where your leads come from
  • Whether consent is traceable and defensible
  • If any numbers are tied to known litigants
  • Whether your traffic patterns signal fraud

Even lead forms that look clean can result in lawsuits if you don’t have proper documentation or verification. One recent court ruling emphasized that proof of consent must be specific, individualized, and tied to a clear audit trail.

High-Risk Industries: Education, Insurance, Home Services

These sectors are especially vulnerable:

  • Education: Admissions teams often buy shared leads. But TCPA rules still apply, and class actions have targeted universities and for-profits alike.
  • Insurance: Agents rely heavily on lead generators—and often don’t realize they’re liable for the seller’s violations. The FCC recently ruled that insurers can be held responsible even if a third party sent the text.
  • Home services: Roofing, solar, HVAC companies are common targets for TCPA lawsuits, especially when texting without verified opt-ins.

What You Can Do Now

Here’s how to protect your business:

1. Scrub for serial litigators

Use a “litigator list” to remove phone numbers tied to known TCPA plaintiffs. Some platforms track 600,000+ such numbers.

2. Validate phone numbers

Don’t just check if a number is mobile—check if it’s real, reachable, and reassigned. Services like Neustar or Telesign can help.

3. Filter traffic for fraud

If you use OTPs or high-volume sends, monitor for signs of SMS pumping: spikes, non-responses, and traffic to unexpected regions. Some CPaaS platforms offer this natively (e.g. Twilio’s AIT guardrails).

4. Get real consent

Capture timestamped, traceable, one-to-one consent. Consider tools like TrustedForm to record consent at the moment it’s given.

5. Use a compliant platform 

Platforms like Meera include built-in TCPA protections — like opt-out handling, number validation, and filters for known bad actors. That’s insurance against fraud and lawsuits.

How Meera Helps You Stay Compliant Without Slowing Outreach

Protecting your business from TCPA risk isn’t just about following the rules—it’s about knowing who you’re messaging before you ever hit send.

Meera integrates directly with Blacklist Alliance to automatically scrub your contact lists, suppressing DNC-listed or high-risk numbers that trigger lawsuits or carrier filtering.

Every campaign also benefits from built-in opt-out handling, fraud detection, and consent tracking, so your team can keep texting with confidence. The result: safer outreach, stronger deliverability, and less time worrying about legal fine print.

Final Thought

Running SMS without fraud protection is like driving without insurance. Everything feels fine—until it isn’t.

If your team is texting leads without validating who they are or where they came from, you're not doing outreach. You're playing litigation roulette.

One fake lead can cost $1,200 in legal fees. One SMS pump can cost $10,000 in carrier bills. And one bad assumption—that a lead is compliant just because a vendor says so—can lead to millions in class-action risk.

You don’t need to be paranoid. But you do need to be prepared.

Want to protect your outreach? Meera can help scrub out toxic leads, flag fraud, and keep your team texting the right people at the right time. Book a demo to learn how.