I have a form where the user can add his phone number then, he receives a verification code on his phone number to log in/register.
Now a user could make too many requests with generated valid numbers to cost me more money (the cost of sending verification codes to all these numbers).
what is the best way to prevent this kind of attack? should I use CAPTCHA? or block users based on their IP address? thank you
