They drain the balance on the SMS gate (authorization in the mobile application), how to protect?

Question

SMS

There is a script like client.php?action=get_code&phone=phone.
Someone thought of substituting numbers there and getting codes, so the balance decreases very quickly. How to protect?

Answer 1

captcha
tokens

Answer 2

Try to remove the phone number from the session to begin with and not pass it in a get request if possible. Each device (you have a mobile application, as I understand it) has a unique id ( how to get it ), limit the frequency and number of SMS for each id.