Skip to main content

Security and Fraud Prevention

  • How can I prevent genuine users from getting blocked by Fraud Shield?

    Plivo’s Fraud Shield is designed to automatically detect and block artificially inflated traffic to protect your Verify applications from SMS pumping events. When such traffic is detected, Fraud Shield blocks delivery to certain destination numbers. number patterns and regions, and returns error code 452 – Potential SMS Pumping.

    The extent of this filtering depends on the Fraud Shield protection level set in your Verify app settings. There are three protection levels:

    • High: Strongest filtering, but with higher false positives
    • Medium: Moderate filtering with fewer false positives
    • Low: Light filtering with lower false positives

    Note: A false positive occurs when a message from a legitimate user is incorrectly identified as fraudulent and blocked by the system.

    If you’re seeing genuine users being blocked, here are ways to reduce false positives:

    • Skip the fraud check for trusted users
      If you have a list of users you trust, you can bypass fraud checks for them by setting check_fs to false when starting their verification.
    • Create separate Verify apps for different use cases
      For example, use separate apps for Sign Up, Sign In, and Password Reset flows. This allows more granular control over traffic behavior and Fraud Shield configuration.
    • Use a dedicated app with low or no protection
      For trusted user segments, create a Verify app with Fraud Shield set to Low or Disabled, and use this app for sending OTPs to known good users.

    If you're still facing issues, please reach out to Plivo Support with the relevant message UUIDs, and we’ll help you troubleshoot further.

  • How can I validate that OTP requests and callbacks are authentic?

    Plivo sends security headers, including X-Plivo-Signature-V2, with every request to your server for callback validation. You can verify these signatures to ensure that the requests are indeed coming from Plivo. For more details, refer to our developer documentation.

    For a step-by-step walkthrough, refer to the video below: