How to organize the protection of the "Verify phone number via SMS code" function?

Question

Programming

Hello!
How to properly organize the protection of the "Verify phone number via SMS code" function on the site? To confirm the phone number, an SMS with a one-time code is sent to it, which must be entered on the site. Everything seems to be convenient. But! After all, maybe some not a good person can start driving in "left" numbers there and SMS will be sent to them, respectively, there will be undesirable SMS sending and extra costs. How to be?

Answer 1

Limit the number of confirmations per IP. Save the phone in cookies and prevent changing the number (entering another one) more than once every X hours.

Answer 2

Everything is like with any spam protection - ip, captcha, cookies, nothing new has been invented yet.