Exponential Backoff for SMS

You must have an Enterprise Plan to use SMS Fraud Protection with Exponential Backoff. Review Auth0 Pricing for more information.

Auth0’s SMS Fraud Protection feature includes Exponential Backoff for SMS phone factors. SMS Fraud Protection helps protect your applications from SMS toll fraud (also called SMS pumping) and automated MFA abuse. When you enable it, your tenant stops using standard static rate limits for SMS verification requests and uses Exponential Backoff instead. Exponential Backoff increases the wait time between requests for each user. Legitimate users can still complete MFA enrollment, while scripted resends become slow and costly for attackers.

How it works

When SMS Fraud Protection is enabled, Auth0 applies a delay to repeated SMS requests for each user identifier.

Behavior	Description
Immediate request buffer	Each user receives an initial allowance of immediate retry attempts to accommodate typos or delivery delays.
Progressive wait times	After the immediate retries, the required wait time increases with each additional request, from 1 minute to a maximum of 32 minutes.
Maximum delay	Wait times do not exceed 32 minutes. Permanent account lockouts are prevented while still maintaining abuse defense.
Timing variation	Auth0 adds a small, random variation (jitter) to each wait time so scripts can’t predict when a request will succeed.
Automatic System Recovery	Delay states are dynamic and tied to recent request frequency. Wait times decrease when a user stops requesting codes. Extended inactivity resets the user’s rate limit.

Enable or disable SMS Fraud Protection

Tenant administrators can enable or disable SMS Fraud Protection at any time. When you disable it, your tenant reverts to standard rate limiting.

Auth0 Dashboard
Management API

Navigate to Auth0 Dashboard > Security > Multi-Factor Auth.
Select Phone.
Choose an SMS send policy:
- SMS Fraud Protection: Uses Exponential Backoff.
- Default send: Uses standard rate limits.
Select Save.

Make a PATCH call to the /api/v2/attack-protection/phone-provider-protection endpoint. Your Management API access token must include the update:attack_protection scope.

curl --request PATCH \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/attack-protection/phone-provider-protection' \
  --header 'authorization: Bearer MANAGEMENT_API_ACCESS_TOKEN' \
  --header 'content-type: application/json' \
  --data '{ "type": "exponential" }'

Value	Description
`type`	SMS send policy. Set to `exponential` to enable SMS Fraud Protection with Exponential Backoff, or `default` to revert to standard rate limits.

To check the current setting, make a GET call to the same endpoint. Your access token must include the read:attack_protection scope.

curl --request GET \
  --url 'https://YOUR_AUTH0_DOMAIN/api/v2/attack-protection/phone-provider-protection' \
  --header 'authorization: Bearer MANAGEMENT_API_ACCESS_TOKEN'

Monitor and audit backoff events

When a user’s SMS request is delayed due to exponential backoff:

The MFA prompt informs the user a temporary wait period is required before requesting a new code.
Auth0 generates a limit_phone event to your tenant logs with the throttled attempt and the remaining cooldown period for auditing. To learn more about limit_phone, review the Tenant Log Catalog.

To view these events:

Navigate to Auth0 Dashboard > Monitoring > Logs.
Filter by type: "limit_phone".

Protect Your Application

Call APIs On User's Behalf

Protect Your Tenant

Exponential Backoff for SMS

How it works

Enable or disable SMS Fraud Protection

Monitor and audit backoff events

Learn more

​How it works

​Enable or disable SMS Fraud Protection

​Monitor and audit backoff events

​Learn more

How it works

Enable or disable SMS Fraud Protection

Monitor and audit backoff events

Learn more