This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue.
Let's say there is an app that allows users to sign up using their phone number.
- user opens the app
- he is presented with a login/register button user
- now wants to sign up as he is a new user. So he clicks on the register button and he is asked for his phone number
- when he submits his phone number, he receives an OTP via SMS. Say the app actually calls the
/registerAPI which is the one that triggers the SMS.
Risk: Now for every outbound SMS, there is a financial cost involved.
Proactive/reactive mitigation measures
- The API is rate limited (based on the phone number)
- There is proper monitoring and alerting in place. So if at all there are abuse instances, extreme measures like IP blocking can happen.
- If an adversary (potentially a competitor) hits the API with different phone numbers, the rate limiting logic is easily bypassed.
- IP blocking may not be viable all the time. Say if the adversary is behind a NATed network, all genuine users behind the network also get blocked from doing any successful sign up.
- If the adversary changes IPs (maybe using Tor), mitigation step 2 mentioned above also gets bypassed.
- Captcha is not a solution as it destroys UX, especially when dealing with mobile apps.
- Having username password instead of OTP for registration verification is not an option because the app needs a verified phone number to function.
- Per device signature can also be used as a factor to rate limit on, but the fact is that too comes from the device over HTTP(s). Hence, easily changeable as well. So this option is also ruled out.
In such a situation, how to protect against the risk or maybe plan and be prepared for it, if at all it can not be sorted ?