Server-side solution to protect from bots?

Question

I have a website where a user needs to register with his mobile phone number. It is verified by sending a verification code by SMS, each SMS costs me €0,10.

I have already implemented a check that if a user enters the same phone number twice he gets the notification "There is already a code sent to your phone number".

But I am worrying about the following: What if someone with malicious intent makes a bot to insert random phone numbers so a lot of SMS's will be sent and it will cost me a lot of money.

A basic solution would be to set the amount of attempts in the session, and if a certain amount is sent to block the session. But a bot could erase its session each try so that ain't really secure I guess.

I could use something like (an invisible) Captcha but I am actually wondering if there is also another server-side solution for this?

I could make a table to log the IP-address and amount of inputs, but people using 4G or a shared Wifi would be excluded so also that ain't a valid solution.

Is there another way to protect against this other then Captcha?

Wow, do SMSes cost that much in Europe? Good grief! Also, VPNs make ip logging less effective. But yes, I'd say captcha. Maybe you could have people register separately and then activate with a phone number, like many sites do. That way you can make account creation hard instead, and make adding a number simpler by having one phone number per account. Of course, maybe adding a phone number is already your way of making account creation hard... — Luke Sawczak, Jun 08 '23 at 04:00
There are many similar questions on this site already. Does this answer your question? Prevent against OTP abuse in app sign up flow, Preventing Signup API abuse from botnet, Protect page sms verification from spamming, Someone uses my service to spam people with sms. How to deal with this?, How To Stop A Mobile Verification Attack. — Steffen Ullrich, Jun 08 '23 at 04:32

Server-side solution to protect from bots?

0 Answers0