> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-feat-exponential-backoff-mfa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Exponential Backoff for SMS

> Learn more about using SMS Fraud Protection feature Exponential Backoff to protect your application against SMS pumping.

<Warning>
  You must have an Enterprise Plan to use SMS Fraud Protection with Exponential Backoff. Review [Auth0 Pricing](https://auth0.com/pricing) for more information.
</Warning>

Auth0's SMS Fraud Protection feature includes Exponential Backoff for [SMS phone factors](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa). SMS Fraud Protection helps protect your applications from SMS toll fraud (also called SMS pumping) and automated MFA abuse. When you enable it, your tenant stops using standard static rate limits for SMS verification requests and uses Exponential Backoff instead. Exponential Backoff increases the wait time between requests for each user. Legitimate users can still complete MFA enrollment, while scripted resends become slow and costly for attackers.

## How it works

When SMS Fraud Protection is enabled, Auth0 applies a delay to repeated SMS requests for each user identifier.

| **Behavior** | **Description** |
| - | - |
| Immediate request buffer | Each user receives an initial allowance of immediate retry attempts to accommodate typos or delivery delays. |
| Progressive wait times | After the immediate retries, the required wait time increases with each additional request, from 1 minute to a maximum of 32 minutes. |
| Maximum delay | Wait times do not exceed 32 minutes. Permanent account lockouts are prevented while still maintaining abuse defense. |
| Timing variation | Auth0 adds a small, random variation (jitter) to each wait time so scripts can't predict when a request will succeed. |
| Automatic System Recovery | Delay states are dynamic and tied to recent request frequency. Wait times decrease when a user stops requesting codes. Extended inactivity resets the user's rate limit. |

## Enable or disable SMS Fraud Protection

Tenant administrators can enable or disable SMS Fraud Protection at any time. When you disable it, your tenant reverts to standard rate limiting.

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Navigate to **[Auth0 Dashboard > Security > Multi-Factor Auth](https://manage.auth0.com/#/security/mfa)**.
    2. Select **Phone**.
    3. Choose an SMS send policy:
       * **SMS Fraud Protection**: Uses Exponential Backoff.
       * **Default send**: Uses standard rate limits.
    4. Select **Save**.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` call to the `/api/v2/attack-protection/phone-provider-protection` endpoint. Your Management API access token must include the `update:attack_protection` scope.

    ```bash lines theme={null}
    curl --request PATCH \
      --url 'https://YOUR_AUTH0_DOMAIN/api/v2/attack-protection/phone-provider-protection' \
      --header 'authorization: Bearer MANAGEMENT_API_ACCESS_TOKEN' \
      --header 'content-type: application/json' \
      --data '{ "type": "exponential" }'
    ```

    | Value | Description |
    | - | - |
    | `type` | SMS send policy. Set to `exponential` to enable SMS Fraud Protection with Exponential Backoff, or `default` to revert to standard rate limits. |

    To check the current setting, make a `GET` call to the same endpoint. Your access token must include the `read:attack_protection` scope.

    ```bash lines theme={null}
    curl --request GET \
      --url 'https://YOUR_AUTH0_DOMAIN/api/v2/attack-protection/phone-provider-protection' \
      --header 'authorization: Bearer MANAGEMENT_API_ACCESS_TOKEN'
    ```
  </Tab>
</Tabs>

## Monitor and audit backoff events

When a user's SMS request is delayed due to exponential backoff:

* The MFA prompt informs the user a temporary wait period is required before requesting a new code.
* Auth0 generates a `limit_phone` event to your tenant logs with the throttled attempt and the remaining cooldown period for auditing. To learn more about `limit_phone`, review the [Tenant Log Catalog](/docs/tenant-logs/system-notification/limit-phone).

To view these events:

1. Navigate to [**Auth0 Dashboard > Monitoring > Logs**](https://manage.auth0.com/dashboard/#/logs).
2. Filter by `type: "limit_phone"`.

## Learn more

* [Configure SMS and Voice Notifications for MFA](/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa)
* [Configure Phone Messaging Providers](/docs/customize/phone-messages/configure-phone-messaging-providers)