Every A2P message that reaches a subscriber without paying the operator’s termination rate is revenue you built the network to earn and never collected. For many operators, that is the daily reality of grey routes.
This blog explains how to protect A2P revenues in practice. You will see what causes leakage, how grey routes are detected, where an SMS firewall fits, and how to sequence the work so it pays back. It is written for operators, aggregators, and enterprises, so technical terms are defined as they appear.
Quick Answer
To protect A2P revenues, an operator or aggregator must detect messages that bypass commercial A2P routes, then block, redirect, or charge for them. This usually combines an SMS firewall at the network edge, SMPP route monitoring for quality and anomalies, clear A2P pricing policy, and direct white route offers that make bypassing unnecessary.
Key Takeaways
- Grey routes, SMS pumping, and OTT bypass are three separate leaks. Each needs a different control.
- Grey routes persist because of price gaps between A2P and P2P rates. Detection alone does not fix a pricing problem.
- Content, sender, and traffic pattern analysis catches grey traffic that simple blacklists miss.
- Not all detected traffic should be blocked. Redirecting or monetising it often recovers more revenue.
- Route monitoring metrics such as delivery ratio, DLR latency, and OTP conversion expose fraud early.
- Published loss figures are forecasts from research firms and vendors, so treat them as indicators, not audited numbers.
What Is Grey Route Fraud?
A grey route is a path that delivers application to person (A2P) SMS to subscribers without the operator’s authorised, correctly priced A2P interconnect. Typically the traffic is disguised as person to person (P2P) messaging, or injected through SIM boxes, so it is billed at a lower rate or not billed at all.
The incentive is price. Juniper Research reported in 2016 that grey route traffic made up more than 30% of A2P messages at the time, and that a grey route message often cost about 25% of a directly connected A2P message. Those numbers are old, but the mechanism has not changed. Wherever a gap exists between the cost of a legitimate route and a bypass route, someone sells the bypass.
Example: A bank’s notification vendor buys cheap international SMS from a reseller. The reseller delivers through local SIM cards in a SIM box in the destination country. The subscriber receives the alert, the vendor saves money, and the destination operator earns only a P2P retail fee, or nothing from the termination side. Nobody in that chain acted unusually from a commercial point of view, which is why grey routes are hard to stamp out.
What Causes A2P Revenue Leakage?
A2P revenue leakage has four main causes: SIM box and P2P disguised traffic, unauthorised interconnect routes, artificially inflated traffic (SMS pumping), and OTT substitution. The first two are classic grey routes. The third is fraud against enterprises. The fourth is a market shift, not fraud.
| Cause | How it leaks revenue | Who is hurt | Primary control |
| SIM box traffic | A2P delivered through local SIMs at P2P cost | Terminating operator | SMS firewall, SIM level analytics |
| Unauthorised A2P over P2P interconnect | A2P sent over routes priced for person to person traffic | Terminating operator | Content and sender analysis at the SMSC edge |
| SMS pumping (AIT) | Bots trigger OTPs to numbers that share fees | Enterprise, sometimes the carrier chain | Traffic monitoring, conversion tracking, rate limits |
| OTT substitution | Enterprises move to WhatsApp, push, or RCS | Operator and aggregator | Multichannel offering, better pricing |
The table matters because teams often buy one tool for all four problems. A firewall will not stop an enterprise from moving OTPs to an app, and a pricing change will not stop SIM boxes by itself.
Published scale: Mobilesquared and Vox Carrier estimated in a white paper that grey routes would cause a cumulative $37.1 billion revenue leakage between 2020 and 2024, an annual average of $7.69 billion. The same release said just under one quarter of almost 2 trillion A2P messages projected for 2024 would travel by grey routes. These are forecasts by a research firm working with a vendor in this market, so use them to size the problem, not to book revenue.
What Is SMS Pumping Fraud?
SMS pumping, also called artificially inflated traffic (AIT) or SMS toll fraud, is fraud in which bots trigger large volumes of OTP or notification requests through a company’s app or web form, sending messages to numbers where a party in the delivery chain earns a share of the termination fee. The enterprise pays for traffic that serves no real user.
It differs from a grey route. In a grey route, the operator loses revenue. In pumping, the enterprise pays inflated bills, while a rogue or opportunistic party in the chain profits. An aggregator or wholesale carrier still has a stake, because carrying pumped traffic damages sender reputation and creates disputes.
Real world reference: Elon Musk stated in late 2022 that Twitter was losing around $60 million a year to fake two factor authentication traffic sent through roughly 390 operators. That figure is a public claim, not an audited number, but it shows how a single login flow can become a cost centre.
OTPs are the usual target because they are triggered by anonymous users and sent instantly. One vendor reports that OTPs make up around 89% of international A2P SMS traffic, which would explain the focus, though that is a vendor figure and should be confirmed before you quote it.
How Do Telecom Operators Detect Grey Routes?
Operators detect grey routes by inspecting traffic where it enters or terminates in the network, then comparing what each message looks like against what genuine P2P messaging looks like. Detection combines content analysis, sender behaviour, volume patterns, and test messages sent from known sources.
Here are the signals that carry the most weight.
Content and sender analysis
P2P messages between people are short, irregular, and conversational. A2P traffic contains templates, URLs, codes, and brand names. A message that reads like a banking OTP but arrives from a consumer SIM is suspect. Sender IDs that rotate, numeric senders that send thousands of near identical texts, and mismatched originating addresses are all flags.
Traffic pattern analysis
A real subscriber sends and receives in a mixed pattern. A SIM that sends hundreds of one way messages per hour, never receives replies, and sends to many unique destinations looks like a SIM box slot. Ratios of mobile originated to mobile terminated traffic, burst timing, and destination spread help separate people from machines.
Test traffic and probes
Operators and wholesale carriers send controlled test messages through suspect routes and check what arrives: the sender ID, the content, the delay, and the path. Sender ID changes or content rewriting on arrival reveal a route that does not behave like a direct connection.
SMPP route monitoring
For aggregators and wholesale carriers, detection also happens on the Short Message Peer to Peer (SMPP) side, the protocol used to exchange messages between messaging applications and SMS infrastructure. Track these per route and per destination:
| Metric | What a problem looks like |
| Delivery receipt (DLR) success rate | Sudden drop, or an unnaturally high rate with no handset confirmation |
| DLR latency | Very uniform or very long delays, which suggest queuing or SIM box throughput limits |
| Sender ID mix | Unexpected rotation or substitution |
| Traffic per MCC/MNC | Spikes into expensive or unusual destinations |
| OTP request to verification ratio | Large volumes of OTPs with few completed logins |
| Throughput (TPS) | Bursts that do not match the customer’s normal traffic profile |
The OTP conversion ratio is the most practical early signal for pumping. If sends to one destination double while verified logins stay flat, something other than growth is happening. Several fraud analysts point to the same gap between sends and successful verifications as the earliest warning sign.
Hypothetical scenario (illustrative): A wholesale carrier sees traffic to a small destination triple over a weekend. DLR success stays above 95%, so quality looks fine. Conversion data from the enterprise customer shows only 2% of those OTPs were ever entered. The carrier holds the route, flags the customer, and avoids paying out on traffic that would have been disputed later.
How Does an SMS Firewall Protect Revenue?
An SMS firewall sits in the signalling path of an operator’s messaging network and inspects each message before delivery. It can allow, block, redirect, or rate limit traffic based on rules and analytics. By stopping grey traffic and steering it toward billable routes, it protects A2P termination revenue and reduces spam and phishing.
It does this in three stages:
- Inspect: The firewall reads signalling and message data, including originating address, content, and routing information, at the SMSC or its signalling interfaces (SS7 or SIGTRAN based, depending on the network).
- Classify: Rules and analytics decide whether the message is genuine P2P, authorised A2P, or suspected grey traffic.
- Act: The firewall delivers, blocks, reroutes, or flags the message for commercial follow up.
An SMS firewall also covers some security threats, such as SMS spoofing and interception attempts on SS7. Revenue protection and security share the same inspection point, which is why vendors bundle them.
Real world reference: Mobilesquared forecast in 2018 that 85% of operators would have deployed SMS firewalls by 2022, and a later paper estimated that 48% had not yet deployed a next generation firewall when the 2020s began. Even allowing for vendor interest in these figures, the direction is clear: firewalls became standard infrastructure for operators that take A2P seriously.
Limits to know: A firewall does not fix a price gap, it needs tuning to avoid blocking legitimate messages, and it only sees traffic that crosses the points where it is installed. Traffic that never touches the monitored interface will not be seen.
A Five Step Plan to Protect A2P Revenues
Start by measuring, then control, then offer a better alternative. Blocking first is the most common way to turn a revenue problem into a customer complaint.
Step 1: Baseline the leak
Compare A2P volumes reported by your wholesale and enterprise customers against traffic seen at your network edge. The gap is your first estimate of leakage. Sample by destination and by sender to find the largest pools.
Illustrative maths: If an operator terminates 10 million unbilled A2P messages a month and its A2P termination rate is $0.02, the unbilled amount is $200,000 a month. Use your own rates, because the real figure depends entirely on your pricing and traffic.
Step 2: Deploy detection
Install or enable an SMS firewall and configure content, sender, and pattern rules. Run it in monitor mode first so you can compare what it flags against known good traffic.
Step 3: Decide block, redirect, or monetise
Not every grey message deserves the same treatment.
| Traffic type | Suggested action | Why |
| Clear SIM box abuse | Block and investigate the source | No commercial relationship to preserve |
| Legitimate enterprise using a bypass reseller | Redirect to a priced A2P route or contact the enterprise | The sender has a real need and can become a customer |
| Spam, phishing, spoofed senders | Block | Customer harm and regulatory exposure |
| Unclear traffic | Rate limit and flag | Avoids false positives while evidence builds |
Step 4: Close the price gap
If A2P is far more expensive than the bypass, the bypass will return. Review termination pricing for high volume enterprise traffic, offer direct connections with SLAs, and consider volume tiers. Direct routes win when they are reliably faster and deliver better receipts, since Juniper’s own commentary noted that grey routes risk delays and non delivery for time critical alerts.
Step 5: Monitor continuously
Fraudsters adapt. Review route quality weekly, keep rules editable without a software release, and feed confirmed cases back into detection. Document who owns each alert.
Why Is A2P Messaging Revenue Declining for Some Operators?
A2P revenue declines for some operators because of grey route leakage, price pressure from low cost bypass routes, and enterprise migration of notifications and authentication to OTT messaging channels such as WhatsApp, in app push, and RCS. Operators that offer no competitive A2P product tend to lose volume without any visible fraud event.
OTT bypass is not fraud. An enterprise that moves OTP delivery to an app notification is making a legitimate choice, and no firewall will stop it. The response is commercial: reliable delivery receipts, competitive pricing, and a multichannel offering that lets the enterprise keep traffic with you across SMS and OTT.
Why it matters for diagnosis: If your firewall reports little grey traffic but A2P revenue is still falling, check migration before assuming fraud. Look at which verticals and sender IDs have stopped appearing in your traffic.
How to Choose Gateway and Wholesale Tooling
Operators and aggregators that need to protect A2P revenues commonly evaluate two layers: an SMS gateway for routing and connectivity, and wholesale tooling for managing carrier and customer relationships. Evaluate by capability, not brand.
Use these criteria:
| Criterion | What to check |
| Protocol support | SMPP for aggregator and carrier links, HTTP API for enterprise apps, plus any signalling interfaces you need |
| Routing control | Rules by destination, customer, price, and quality, with automatic failover |
| Visibility | Per route DLR, latency, and throughput reporting you can export |
| Fraud controls | Rate limiting, destination blocking, and alerting hooks |
| Wholesale functions | Rate management, customer and vendor accounts, billing data |
| Scale and reliability | Tested TPS, redundancy, and monitoring |
| Integration | Compatibility with your existing SMSC, firewall, and billing systems |
An SMS gateway connects messaging applications with telecom infrastructure so organisations can send and receive SMS programmatically. An SMS wholesale solution adds the commercial layer for buying, selling, and pricing traffic between carriers and customers. TeleOSS offers SMS Gateway Software and an SMS Wholesale Solution in these categories.
Trade off to consider: A gateway with strong routing and monitoring helps an aggregator spot bad routes, but it is not a substitute for an operator side SMS firewall. Operators with in network grey traffic need inspection at the signalling layer. Aggregators and CPaaS providers benefit most from route level controls.
Common Mistakes to Avoid
- Blocking before measuring: Without a baseline you cannot show recovered revenue, and you may block genuine traffic.
- Treating every grey message as fraud: Many senders are legitimate enterprises on a cheap route. Convert them.
- Ignoring pricing: Detection without a price response creates an endless chase.
- Watching delivery rate only: Pumped traffic can show healthy DLR numbers. Track conversion.
- Static rules: Fraud patterns change. Rules that need a code release will be out of date.
- No owner: Revenue assurance, fraud, and commercial teams each hold part of the picture. Assign one owner for the loop.
Conclusion
To protect A2P revenues, treat grey routes, SMS pumping, and OTT migration as separate problems. Measure the leak first, detect with content, sender, and pattern analysis, decide whether each traffic type should be blocked, redirected, or priced, and close the price gap that created the bypass market. Keep monitoring, because the fraud adapts.
Published loss estimates such as $37.1 billion over 2020 to 2024 are forecasts, so the real number to chase is your own baseline.
Next step: If you run an operator, aggregator, or CPaaS network and want to see where A2P traffic is leaking, talk to the TeleOSS team about SMS Gateway Software and the SMS Wholesale Solution. Share your route and traffic profile, and you will get a deployment discussion grounded in your own network, not a generic pitch.
FAQs
What causes A2P revenue leakage?
A2P revenue leakage comes from SIM box delivery, A2P traffic sent over P2P or unauthorised routes, artificially inflated traffic that benefits intermediaries, and enterprise migration to OTT channels. The first two are grey routes. Price differences between legitimate and bypass routes are the underlying driver.
How do telecom operators detect grey routes?
Operators detect grey routes by analysing message content, sender behaviour, and traffic patterns at the network edge, often with an SMS firewall. They also send test messages through suspect routes and compare what arrives with what was sent. Unusual MO to MT ratios and bursty one way traffic are common indicators.
What is SMS pumping fraud?
SMS pumping, or artificially inflated traffic, is fraud where bots trigger mass OTP or notification requests so messages go to numbers that earn a share of termination fees. The business pays for messages no real user needs. It is usually spotted when send volume rises but verified logins do not.
How does an SMS firewall protect revenue?
An SMS firewall inspects messages in the network, identifies A2P traffic arriving through unauthorised or disguised routes, and blocks or redirects it. That pushes sender traffic toward billable A2P routes and also reduces spam, spoofing, and some signalling based attacks.
Why is A2P messaging revenue declining for some operators?
Causes include grey route leakage, low priced bypass offers, and enterprises moving authentication and alerts to WhatsApp, push, or RCS. Operators without competitive pricing, reliable delivery receipts, or a multichannel offer lose volume gradually, often without a visible fraud event.
Should I block all grey route traffic?
No. Block clear abuse such as SIM box farms and spoofed phishing. For legitimate enterprises using cheap resellers, redirect or contact them with a priced A2P offer. Rate limits unclear traffic while evidence builds. Blocking everything risks complaints and lost customers.
Can an aggregator or CPaaS provider protect A2P revenue without an SMS firewall?
Partly. Aggregators can use route monitoring, DLR analysis, conversion tracking, rate limits, and destination controls inside their SMS gateway. These protect margin and reputation, but they do not inspect network traffic the way an operator side firewall does.
