SMS.to does not refund or credit charges for messages sent from your account as a result of a fraud attack. This article explains why, and how you can protect your account.


What counts as a fraud attack

This policy applies to all SMS.to channels, including SMS, WhatsApp, Viber and Verify/OTP. It covers charges caused by:

  • SMS pumping / Artificially Inflated Traffic (AIT): bots triggering OTP or sign-up messages to premium or fraudulent numbers.
  • Account takeover: someone accessing your account with stolen login credentials.
  • Leaked API keys: keys exposed in code, apps or websites, or shared with third parties.
  • Abuse of your forms or apps: unprotected sign-up, login or contact forms used to trigger messages.


Our refund policy

All messages sent through your SMS.to account, using your login credentials or API keys, are treated as sent by you and are charged at your account rates. This applies whether or not you authorised the traffic.

SMS.to does not issue refunds, credits or balance adjustments for fraudulent traffic sent through your account, forms, apps or API integration.


Why we can't refund fraudulent traffic

  • Delivery costs are already paid. Once a message is sent, SMS.to pays the mobile operators to deliver it, and those charges cannot be recovered.
  • You control your account security. Your login details, API keys, sending limits and the forms that trigger messages are in your hands.
  • Fraudulent traffic looks legitimate. It arrives through your valid credentials, so it cannot be told apart from your normal traffic.


How to protect your account

Keeping your account secure is your responsibility. We recommend that you:

  • Keep your login details and API keys private, and never expose keys in front-end code or public repositories.
  • Enable IP whitelisting so only your trusted servers can use the API.
  • Allow sending only to the countries you actually need.
  • Set a daily spending limit, with email warnings before you reach it.
  • Protect sign-up, login and OTP forms with CAPTCHA and rate limiting.
  • Watch your usage and balance, and contact support straight away if you notice anything unusual.


For step-by-step instructions on IP whitelisting, daily spending limits and country restrictions, read our Fraud Prevention Security Settings article.


If you have any questions, please send an email to support@sms.to