I'm developing a merchant page where users can pay their bills. On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC).
As a verification, we have a phone field where the user inputs a phone number and submits (with AJAX). After that, an SMS with OTP is sent to that number. In this part, intruders (or hackers) can spam it by sending fake queries, which will cost us some money.
How do we defend from this type of attack? How do we set a limit for users to only allow one request (1 SMS) in two minutes?
The option of creating a database and storing phone numbers and sender IP is not a suitable variant.