I have a form where the user can add his phone number then, he receives a verification code on his phone number to log in/register.

Now a user could make too many requests with generated valid numbers to cost me more money (the cost of sending verification codes to all these numbers).

what is the best way to prevent this kind of attack? should I use CAPTCHA? or block users based on their IP address? thank you

  • @SteffenUllrich this doesn't only answer the question, this is a treasure! thank you
    – DAMAR225
    May 15 at 18:20


Browse other questions tagged .