I'm developing a web based service in which users must validate their mobile phone (using a code sent to their mobile number via SMS) and email (using a verification link). Currently I use time limiting method to prevent sending more than one SMS or email in a specified period. But both of these security factors can be changed by users whenever they want and by changing them, their time limit will be resetted too.

A hacker can automate this process (since I don't want to use captcha in user's panel) and infliction us to send a lot of SMSs. How can I prevent it? One idea is that to lock users from changing these information too fast but I don't know if it is the best way or not because users might fill these informations wrongly and want to change them instantly.

  • 2
    All the big sites use capcha for such cases. Trying to avoid them will only limit what you can control. You don't mention your current throttling criteria but I get the impression it's really bad since you say a hacker can reset it. Sep 2, 2016 at 21:25
  • @JuliePelletier Thank you. Yes, using captcha is a good option but I wanted to know if there are better methods or not in such cases. Sep 2, 2016 at 21:27
  • There is no perfect solution but avoiding captcha increases the chances of getting hit by a bot. What are your current throttling criteria? Sep 2, 2016 at 21:30

1 Answer 1


It seems you're rate-limiting per phone number/e-mail address.

You could apply the rate-limit per user instead, and it would prevent the kind of abuse you're worried about.

You should tweak the limit to account for that. For instance two SMS per user per day would allow for one mistake to be made. If the user makes a second mistake she'll have to wait till next day to fix it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .