I'm developing a merchant page where users can pay their bills. On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC).

As a verification, we have a phone field where the user inputs a phone number and submits (with AJAX). After that, an SMS with OTP is sent to that number. In this part, intruders (or hackers) can spam it by sending fake queries, which will cost us some money.

How do we defend from this type of attack? How do we set a limit for users to only allow one request (1 SMS) in two minutes?

The option of creating a database and storing phone numbers and sender IP is not a suitable variant.

  • 1
    Why are you using SMS for this? Why not an emailed one-time link? – schroeder Oct 25 '19 at 13:31
  • 2
    Why does the user need to fill in his phone number each time rather than use the one that is on file? – Ángel Oct 25 '19 at 15:21
  • 1
    Don't reinvent the wheel: Use a 2FA provider that has solved this and other problems, e.g. how to block premium numbers. – Reinstate Monica - M. Schröder Oct 26 '19 at 11:48
  • @schroeder we do not ask user's email for sign up, but we require phone number – Daler Azimov Oct 30 '19 at 7:39
  • @Ángel which file do you mean? – Daler Azimov Oct 30 '19 at 7:39

You have two areas where you can control this. First, you can control the user/number pair spamming by recording the number you sent an SMS to and limiting the number of messages your system can send to that number.

For the case where someone generates multiple users and multiple numbers, you can control that on the user-creation process before the SMS part. In this case, you can limit the number of accounts created by an IP in a certain timeframe. That prevents the SMS from being a problem in the first place.

And you always have the opportunity to rate-limit the total number of texts your system sends.

|improve this answer|||||
  • Thanks for your answer, Schroeder. The problem with area one – to record all data it will need to create DB and it will require a lot of memory. Now, service is not big enough and this solution is okay, but in future, this service is going to be big, and to record all data will be problematic. – Daler Azimov Oct 30 '19 at 7:38
  • The problem with area two – it also require a lot of memory to record all data. In addition, on this project, people sign up and using this service is optional choice, not every user is going to use it, and it will require a lot of memory to record absolutely all project data, this is not an option. I need solution to protect only one page from spamming. Thanks. – Daler Azimov Oct 30 '19 at 7:38
  • I don't think you understand. This requires very little space and can be maintained in memory easily. Especially since the items do not need to persist. No DB needed. – schroeder Oct 30 '19 at 7:41
  • Can you explain this to me in a little more details? Thanks. – Daler Azimov Oct 30 '19 at 7:42
  • Please tell me that you are logging when you send SMS ... – schroeder Oct 30 '19 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.