In short
Genuine growth spreads across the subscriber base and is accompanied by other network activity: calls, data, outbound messaging. AIT concentrates in narrow number ranges that receive verification codes and do nothing else. Distribution shape and correlated activity separate the two more reliably than volume alone.
Volume alone cannot answer it
A platform launching in a market produces a sharp OTP increase. So does an AIT operation. Both appear as a step change in the same traffic category from the same kind of sender, and an operator looking only at volume charts has no basis to distinguish them.
The distinction lives in how that volume is distributed and what accompanies it.
The distinguishing tests
Five comparisons, any of which is informative and which together are conclusive:
- Distribution shape — genuine growth spreads broadly across the subscriber base; AIT concentrates in narrow prefix blocks
- Correlated activity — real users also call, use data and send messages; AIT ranges receive codes and nothing else
- Conversion — real verification leads to account creation and subsequent app traffic; AIT verification leads nowhere
- Timing — real users follow a daily rhythm; automated requests are evenly distributed
- Platform diversity — a real subscriber verifies with a few services; AIT numbers receive codes from many unrelated platforms at once
Ambiguous cases
Some legitimate scenarios mimic parts of the AIT profile. IoT and M2M number ranges genuinely receive automated traffic without human activity patterns. Data-only SIMs generate no voice. A promotional campaign offering incentives for sign-ups produces a real but short-lived spike with poor conversion.
These are why the correlation matters rather than any single test, and why confirmed cases should be reviewed by an analyst before enforcement rather than actioned automatically.
Working with the enterprise
The fastest resolution is usually to ask. The platform generating the traffic can see its own conversion rate per destination range, which the operator cannot, and has a direct financial interest in stopping AIT because it is the party being billed.
Operators that treat an AIT finding as a joint investigation rather than an accusation generally resolve it faster and retain the traffic afterwards.