Your SMS sending account was suspended in Morocco: the real reasons and the steps to follow

An account suspension by a [SMS pass] (/fr/api-sms-maroc/) is never random. It is triggered by strict security algorithms or direct complaints from Moroccan telephone operators (IAM, Orange, inwi).

Before you panic or open an aggressive support ticket, here are the most common reasons for suspension in Morocco and the procedural steps to reactivate your account as soon as possible.

A suspension is intended to protect the overall infrastructure: if your traffic is perceived as a threat, the operator can block the entire gateway.

1. Abnormally high failure rate (the "Basic Selling") This is the reason number one. If your database is purchased or old, you will record a huge rebound rate. If your account has a failure rate (DLR Failed for non-existent numbers) of more than 15% or 20%, anti-fraud filters will consider you to be doing "ping" or blind spam.

2. CNDP (Active Spam) Notifications and Complaints Moroccan users who receive unsolicited messages (no opt-in) or no opt-out notice (STOP SMS) complain directly to operators or on social networks. If the operator returns a complaint to the SMS provider, the account suspension is immediate, often with the obligation to justify the collection of consent.

3. Sender ID Usurpation (Phishing) If you try to send a message by forcing the Sender ID of a bank (e.g. CIH BANK, ATTIJARI), an administration or brand that is not yours, without providing the supporting documents, the anti-phishing system will block your access immediately.

Sudden Suspicious Volume (API Compromise) Your start-up sends 100 SMS per day for OTP validation. Suddenly, at 3 a.m., the API receives a request to send 50,000 SMS to international numbers or to a Moroccan number overpaid. This "Volume Alert" indicates that your API key has leaked (probably on GitHub or via a fault in your server). The gateway cuts access to limit financial hacking.

Do not seek to create another account in an emergency (it will be suspended by IP address or company name association).

• For a API key leak: Reactivation usually takes less than 2 hours. Support will ask you to generate a new API key and prove that you have secured your server.
• For a high failure rate: Count 24 hours.You will need to prove that you have deleted or cleared the wrong contact list.
• For a spam or phishing complaint: The blocking can last several days, or even be permanent. You will need to provide legal evidence (opt-in logs, IP addresses of the complaining user registration).

Take a procedural approach with technical support:

1. Stop your server-side scripts. No need to bombard the API with requests that will be rejected, this makes it difficult to read logs for support.
2. Open a clear ticket. Do not say "It no longer works". Say "Our ID account [XXX] was suspended at [Time]. The last shipment was the campaign [Name]. Could we know the reason (rebound rates, complaint, volume)?"
3. Give proactive evidence. If you know your key has leaked, report it immediately.If the suspended campaign was legitimate, attach a CSV sample showing your customers’ opt-in dates.

To sustain your shipment architecture to Morocco: - Implement a cleaning loop. Your code must listen to the webhooks DLR and locally blacklist any number that returns a status Failed (non-attributed number). - Return your API keys regularly (Key Rotation) and never clear them into your front-end code or Git deposits. - Always add an opt-out option. The cost of an SMS opt-out (STOP) is negligible in relation to the financial and reputational cost of a account suspension.