SMS rate limiting

Limits are enforced at several layers, which is why the cause of a blocked code is not always obvious:

• The app or website. Most services cap verification requests per phone number, per account, per IP address or per device, for example a few codes per hour, and add longer cool-downs after repeated attempts.
• The SMS gateway or verification provider. Messaging platforms apply throughput limits and fraud filters on top of the app's own rules.
• Carriers. Mobile networks throttle or filter traffic that looks like spam, and apply registration-based throughput limits to business messaging such as A2P SMS.

When a limit is hit, users see messages like "Too many attempts, try again later", or the code simply never arrives.

Rate limiting protects both users and businesses. It slows brute-force guessing of OTP codes and makes SMS pumping, where fraudsters trigger large volumes of texts to numbers they profit from, more expensive. The side effect is that legitimate users who tap "Resend" repeatedly can lock themselves out for a while.

Handling a rate limit legitimately

1. Stop requesting new codes and wait. Cool-downs often clear in minutes to hours.
2. Check the number format, including the country code (see E.164).
3. Confirm the number can receive SMS from that sender.
4. Use a different verification method the service offers, such as email or a voice call.
5. Contact the service's support if the block persists.

Do not try to evade rate limits with scripts or rotating numbers; that is against most platforms' terms. Our guide on why a verification code never arrived covers other causes.

Limits also apply in the other direction. Personal lines have fair-use caps, and business senders face carrier throughput tiers. On PhoneBorn, every plan includes unlimited incoming SMS and 500 outgoing SMS per month, and bulk or marketing messaging is prohibited under the acceptable use policy.