SMS rarely makes it onto the security roadmap.
It arrives as a line on a telecom invoice, and finance approves it. Many security teams have never seen the number, and a guess could be off by a factor of ten in either direction.
Then we put one sentence in a product email saying we could lower your SMS costs, and one of the largest US healthcare companies replied within days. They wanted to talk about text messages.
That got my attention. When an organization that size asks about a per-message fee, the number is not small.
What SMS MFA on every login really costs
Most MFA deployments run on one rule: challenge every user, every time. The rule is easy to explain and audit, and it works as security. As economics, it puts a toll booth on every login you own.
Only part of that bill shows up on an invoice.
Challenge every loginOne rule, four costs
- On the invoicePer-message cost$0.0083 → ~$0.06 per OTPSurcharges and managed verification multiply every code.
- On the invoiceAbuse costUp to 40% of traffic pumpedPumped texts cost the same as real ones.
- Never invoicedFriction costAbandoned sessionsPlus help-desk calls and prompt fatigue.
- Never invoicedSecurity costZero signalIt fires the same for an employee and a bot.
Per-message cost
The per-message cost is the obvious one, and it is worse than the headline rate suggests:
- The base rate. A US SMS segment lists at $0.0083, but carrier surcharges land on top of that.
- Carrier surcharges. AT&T charges $0.0035 per message for registered 10DLC traffic and $0.0100 for unregistered, nearly three times as much, and Verizon raised its registered rate to $0.005 on October 1, 2026, according to Bandwidth's carrier surcharge schedule.
- Registration fees. Registering a campaign costs a $15 vetting fee per attempt, per The Campaign Registry's fee schedule and Vonage's 10DLC pricing.
- Managed verification. If you buy OTP as a managed verification product rather than raw messaging, the arithmetic changes character entirely: Twilio Verify charges $0.05 per successful verification on top of the message, so a US SMS verification costs about $0.06, seven times the segment underneath it.
Geography multiplies all of it. The same OTP that costs $0.0083 in the United States lists at $0.056 in the UK, $0.083 in India, $0.112 in Germany, and $0.195 in Saudi Arabia. If your consumer base is international, you are not paying the US price you budgeted with.
Abuse cost
The abuse cost is the one that grows while you sleep. Attackers worked out years ago that an open OTP endpoint is a billable one. Industry estimates put artificially inflated traffic at somewhere between 5% and 40% of international A2P volume depending on the route, with one brand reportedly seeing its SMS costs spike 256% inside a single week. Pumped OTP traffic is paid for at the same per-message rate as the real thing, so whatever your volume is, it is higher than you think.
Friction cost
The friction cost never gets invoiced at all, which is exactly why it survives. Every challenge you did not need is an abandoned session, a call to a help desk that costs real money to staff, or a user who has been trained to approve prompts without reading them.
Security cost
There is a security problem hiding underneath the money. A challenge you send to 100% of logins carries no information. It fires identically for the employee on her own laptop, on her own network, at the same hour she logs in every weekday, and for the credential-stuffing bot in a rented data center. Because it can't tell a risky sign-in from a low-risk one, you are paying full price for a check that tells you nothing.
How risk-based step-up decides when to challenge
Risk-based step-up checks each sign-in before it decides whether to send a code. SecureAuth Assurance Authority looks at signals such as how trusted the IP address and location are and whether the user has signed in from this device before. It combines them into one level-of-assurance score. When the score is high, the user signs in without a prompt; the score is the invisible MFA. When it drops, for example on a new device, SecureAuth asks for a second factor. Scoring continues after sign-in, so a session that starts to look wrong can be challenged again.
Risk-based step-up challenged only 15% of real member logins
During an evaluation, a large US health insurer asked a fair question: if we turn this on, does signing in get harder for our members? We answered it with their own data.
I took a real per-user login sample from their environment: 133 users and about 2,840 logins over three months. I scored every session with SecureAuth Assurance Authority, which combines IP trust, location trust and device identity into one level-of-assurance score. Step-up only applies to returning sessions, so I left out first-time enrollment and looked only at logins from known users.
- Step-up rate: about 15%. The other 85% of returning logins were never challenged: the engine's confidence in the device, network and location acted as invisible MFA, so the organization could trust the sign-in without sending a code.
- Average assurance score: about 85 out of 100.
- About 91% of the friction that remained came from a new-device event, which is precisely the moment you want a challenge to fire.
Roughly one login in seven still gets challenged, and I would rather report that honestly than round it in our favor. But hold it against the policy it replaces: challenging every user every time means a step-up rate of 100%. Cutting that to 15% removes 85% of the challenges, with invisible MFA verifying those logins instead, and the average assurance score stays at about 85 out of 100. The engine did not trade security for convenience. It stopped spending money to confirm things it already knew, and spent it on the logins that had not earned anything yet.
The business case for challenging fewer logins: Cut SMS costs
Take a tenant doing 1 million consumer logins a month. That is a realistic mid-size consumer property and comfortably below what our largest deployments handle.
At published US rates an outbound OTP runs about $0.0083 per message plus $0.0035 to $0.005 in carrier fees. Call it $0.0118 delivered, the low end of that range.
| Policy | Messages a month | Cost a month | Cost a year |
|---|---|---|---|
| Challenge every login | 1,000,000 | ~$11,800 | ~$142,000 |
| Risk-based step-up at 15% | 150,000 | ~$1,770 | ~$21,000 |
Roughly $120,000 a year that stops leaving the building. One tenant. Before you count resends, multi-segment templates, international destinations that cost several times the US rate, or the pumping traffic you are currently paying to serve.
Run the same arithmetic through a managed verification product at $0.0618 per verification, the $0.05 fee plus the delivered message, and the gap widens to roughly $630,000 a year. Run it for a customer whose users are mostly outside the US and it widens again.
Your numbers will land somewhere else. The mechanism will not.
How to estimate SMS savings
Risk-based authentication gets sold as a security upgrade, and it is one. But the reason it survives a budget review is simpler than the pitch: the best MFA is invisible MFA: the MFA your users never see, and the cheapest OTP is the one you never send.
If you are challenging every login today, you already own the data to size this yourself. Pull three months of login records and ask how many came from a device, a network, and a location you would have trusted anyway.
In our experience it is most of them. At the insurer above it was 85%.
About the data
Prices are published list rates, linked where they appear. The internal figures (the 133-user login sample and the 15% modeled step-up rate) are SecureAuth's own analysis: a directional model, not a billed result. Device identity in the model came from the platform family rather than the full 57-signal fingerprint used in production, so treat the percentages as give or take a few points.
FAQ
What is SMS pumping?
SMS pumping is a fraud scheme, also called toll fraud or artificially inflated traffic (AIT). An attacker scripts a bot to hit your public OTP endpoint, usually sign-up, login or “resend code,” with thousands of phone numbers. Those numbers are typically premium-rate or international numbers the attacker controls, or works with a rogue carrier on. You pay to send every text, and the attacker gets a cut of the termination fees. No account is ever compromised. The attack is your SMS bill.
What is invisible MFA?
Invisible MFA verifies a user without asking them to do anything. Instead of sending a code, it checks signals the user already brings to every sign-in, such as a known device, a trusted network and a familiar location, and turns them into a confidence score. When the score is high, those signals do the work of the second factor and the user signs in without a prompt. When the score drops, it falls back to a visible challenge such as a push, a passkey or a one-time code. In the health insurer analysis above, invisible MFA verified about 85% of returning logins.
Is risk-based MFA the same as adaptive MFA?
Mostly, and the terms are often used interchangeably. Both weigh the risk of each sign-in before deciding what to ask for. Risk-based MFA, as described in this post, decides whether to challenge at all: a high-confidence sign-in goes through without a prompt, and a low-confidence one gets a second factor. Adaptive MFA also changes how it challenges, matching the method to the risk, for example a simple push when risk is low and only phishing-resistant methods when risk is high. SecureAuth does both: Assurance Authority scores every sign-in, and adaptive MFA picks the method when a challenge is needed.