IOSOR Learn
Fraud Second Month: Burn Caps After the First OTP Month
Understand why velocity caps remain active during the second month of traffic to prevent burn-and-run fraud in a prepaid CPaaS environment.
Fraud Second Month: Burn Caps After the First OTP Month.
Transitioning from Month One to Month Two
Successfully navigating the first thirty days of high-volume OTP delivery is a significant milestone for any white-label platform user. However, the transition into the second month does not imply an immediate removal of all safety protocols. In the prepaid ecosystem, the risk profile shifts from initial entry validation to preventing long-term account takeover or credit exhaustion. While Velocity caps before production OTP focus on preventing immediate system abuse, the second month requires a sustained approach to ensure that traffic patterns remain consistent with legitimate business growth.
Why Velocity Caps Persist
Velocity caps are not merely a 'new user' hurdle; they are a permanent fixture of a healthy messaging environment. Even after the initial trust is established, these caps prevent sudden spikes that could indicate a compromised API key or a 'burn-and-run' attempt. In such scenarios, a bad actor might maintain a clean profile for thirty days only to attempt a massive surge in the second month. By maintaining these caps, the platform ensures that SMS and OTP traffic does not exceed the capacity of the assigned routes or trigger upstream filters that could damage sender reputation.
The USD 1,000 Soft Review Threshold
As your account scales, certain financial milestones trigger automated and manual health checks. Specifically, when monthly spending approaches the USD 1,000 mark, a soft review is initiated. This is not an audit, but a verification of traffic quality and DLR (Delivery Receipt) ratios. This review ensures that the JIT (Just-In-Time) number assignment and prepaid balance management are functioning correctly. It also provides an opportunity to adjust throughput limits for 10DLC or international routes based on actual performance rather than theoretical projections.
Differentiating Burn Caps from Invoice Recon
It is critical to distinguish between operational burn caps and the financial reconciliation process. While Fraud invoice week: burn rows vs billable OTP deals with the alignment of ledger entries and actual usage, velocity caps are real-time technical limiters. Burn caps are designed to stop traffic before it happens if it violates safety parameters, whereas reconciliation happens after the fact. The ledger must always reflect the real-time consumption of the USD 20 prepaid floor, ensuring that no account goes into a negative balance during a high-velocity event.
Technical Guardrails for OTP Delivery
| Feature | Month 1 Status | Month 2 Status | Purpose |
|---|---|---|---|
| Velocity Cap | Strict | Adaptive | Prevent spikes |
| Prepaid Floor | USD 20 | USD 20 | Minimum liquidity |
| Soft Review | Initial | At USD 1,000 | Quality assurance |
| JIT Assign | Active | Active | Resource efficiency |
| Webhook HB | Monitored | Standard | System health |
Start with IOSOR
On the first calendar day of month two, recalibrate burn caps against last month’s OTP mix — retry ratio, destination share, and identity class — not against the incident-week breach number. Month-two traffic looks like growth; the mix has already drifted. Set the new ceiling before the first weekday blast.
IOSOR takeaway
Second-month burn caps are a calendar reset after the first OTP month, not an incident-week freeze and not last month’s leftover ceiling.
Do: retune burn caps on day one of month two from the actual mix, then hold that ceiling through the first weekday.
Don't: copy the incident breach number as the new cap, or keep month-one headroom because volume looks healthy.
Was this guide helpful?
Related guides
- Transferring Fraud Threshold Rules During Engineering Team Handovers
Audit operational velocity thresholds and alerting contacts during platform team transitions to maintain continuous abuse protection.
- Setting Destination Traps to Detect Automated Pumping in Pilot Phase
Deploy dummy destination triggers during initial pilot volume testing to catch automated scripts and prevent fraudulent pumping before full production launch. Protect your platform with strategic honeypots.
- Restoring Safe Traffic Volume Through Granular Prefix Allowlist Rules
Learn how to safely ramp SMS traffic after a fraud incident by implementing strict prefix allowlists, JIT number assignment, and monitoring USD thresholds within IOSOR.