I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an unlimited number of phones? It would cause damage in a number of ways. It would consume my SMS package, thus costing me money plus preventing sign up of legitimate users. It would also cause inconvenience to those who would receive these text messages.
I thought of IP blocking but I think that would not stop a distributed attack and it would block legitimate users from that IP. I thought of using a CAPTCHA but that is not very convenient for mobile users and even though it will slow down the attack by a ratio, it will not be enough to completely prevent it.
How do websites like Facebook, Google, Microsoft etc. deal with this?