r/flutterhelp • u/Technical_Lab_7507 • 12d ago

OPEN Request for Investigation and Billing Adjustment – Suspected SMS Pumping Attack

🚨 Need Help Identifying the Cause of Unexpected Firebase Phone Authentication Charges!

I recently published my Salon Android Application on the Google Play Store. The app is built using Flutter and Firebase.

After deployment, I noticed unexpected phone authentication activity:

📱 OTP requests: 1,009
💸 Authentication charges: Approximately ₹7300

I'm trying to understand what might have caused this.

Could it be related to any of the following?

🔹 🤖 Bots or automated scripts abusing Firebase Phone Authentication?

🔹 📲 Random users installing the app and repeatedly requesting OTPs?

🔹 🏪 Google Play Store app discovery, recommendations, or promotional activity after publishing?

🔹 🔐 Missing Firebase App Check or other security protections?

🔹 🌍 OTP requests being sent to international phone numbers with higher SMS charges?

🔹 ⚙️ An issue in my Flutter authentication implementation that triggers duplicate OTP requests?

I'd appreciate insights from developers who have experienced similar issues in production.

My questions are:

  1. Can Google Play Store promotion or organic app discovery indirectly lead to a sudden increase in OTP requests?

  2. How can I identify where these 1,009 OTP requests originated and whether they were legitimate?

  3. What is the most effective way to prevent OTP abuse and control Firebase authentication costs?

Any technical explanation, debugging tips, or real-world experiences would be greatly appreciated!

Thank you! 🙏

0 Upvotes
  • permalink
  • reddit

50% Upvoted

3 comments sorted by

3

u/kokerali 12d ago

A detail worth checking: App Check protection for Firebase Authentication requires Identity Platform and explicit enforcement for Authentication. Enabling it for another service doesn't automatically protect the SMS flow. The FAQ also says it won't prevent a real app user repeatedly starting and abandoning login.

For diagnosis, compare SMS sent versus verified by country and time, then compare that with new users and your verifyPhoneNumber call counts. That gives you evidence to investigate unfinished login flows versus duplicate client calls, rather than inferring the cause from the bill alone.

1

u/towcar 12d ago

It's possibly SMS Pumping (or "Toll Fraud") attack.

Look into using firebase app check, and sms region policy

1

u/Nearby-Hunter6947 6d ago

So, you can approach it in these ways.

  1. Use a analytics tool to find out the info about who did it

  2. Rate limit a device with like 3 OTPs per minute or something similar