Here is the scenario:
I have an application, whose one feature/part is to generate voice calls. I have also provided a (working) demo to generate calls from the website, by inputting your number (without login). To avoid misuse, I have added a CAPTCHA and IP limit.
But there is a user, who manually enters a phone number and keeps on generating calls. They keep on changing their IP, so CAPTCHA and IP limit, both don't work. And it costs me money, as they mostly generate international calls. Blocking international calls, is also not an option, as I provide international service too.
Is there any way to prevent this, without removing the free demo?
I was thinking of doing this using MAC address, or something similar, which blocks a particular computer but I know there will still be loophole due to MAC address spoofing.
How can I solve this? I am using PHP.