Protect your startup from $10,000 SMS toll fraud (AIT): implement Cloudflare Turnstile, WhatsApp OTP fallbacks ($0.005/msg), and Twilio Verify Fraud Guard.
// app/api/auth/send-otp/route.ts
export async function POST(req: Request) {
const { phone, turnstileToken } = await req.json();
// 1. Verify Turnstile Captcha to kill automated bot traffic (Free)
const verifyRes = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({ secret: process.env.TURNSTILE_SECRET!, response: turnstileToken })
});
const outcome = await verifyRes.json();
if (!outcome.success) return Response.json({ error: "Bot detected" }, { status: 403 });
// 2. Dispatch via Twilio Verify with Fraud Guard active
const client = require("twilio")(process.env.TWILIO_SID, process.env.TWILIO_AUTH);
const verification = await client.verify.v2.services(process.env.VERIFY_SERVICE_SID)
.verifications.create({ to: phone, channel: "sms" });
return Response.json({ status: verification.status });
}SMS verification is one of the most dangerous cost vulnerabilities for SaaS startups. Fraud rings deploy automated bots to trigger thousands of SMS verifications to high-cost premium-rate international phone numbers (Artificial Inflation of Traffic - AIT / SMS Pumping). With US SMS rates hovering around $0.0079/msg and international destinations ranging from $0.15 to $0.85/msg, an unprotected signup form can rack up thousands of dollars in carrier fees overnight.
Building a cost-effective authentication pipeline requires a multi-tier fallback architecture: WhatsApp / Passkeys → Email OTP → Direct Carrier SMS, backed by Cloudflare Turnstile and strict geo-velocity throttling.
| Verification Strategy | Primary Channel | Fallback Channel | Carrier Surcharges | Total Monthly Bill |
|---|---|---|---|---|
| Naive SMS (Twilio Standard) | Direct SMS ($0.0083/msg) | None (Retry SMS) | $185.00 (Carrier pass-through) | $600.00 / month |
| WhatsApp-First + SMS Fallback | WhatsApp Auth ($0.005/msg) | SMS only if unread in 60s | $45.00 | $195.00 / month (67% Savings) |
| AWS SNS Global SMS | Direct SMS ($0.00645/msg) | None | Variable carrier fees | $450.00 / month |
| Passkey (WebAuthn) + Email First | Passkey ($0.00) | Resend Email ($0.0004/msg) | $0.00 | $20.00 / month (96% Savings) |
Before triggering a paid SMS dispatch via Twilio or AWS SNS, pass the destination phone number through a Home Location Register (HLR) lookup or Twilio Lookup API ($0.005/lookup). If the carrier type returns `voip` or `landline`, immediately reject the request and prompt for email or authenticator app verification. This single validation blocks over 90% of automated toll-fraud scripts targeting SaaS registration endpoints.
import Redis from 'ioredis';
const redis = new Redis(process.env.REDIS_URL);
// Block automated SMS pumping attacks before hitting carrier gateways
export async function assertOtpAllowed(ip: string, phoneNumber: string): Promise {
const ipKey = `ratelimit:otp:ip:${ip}`;
const phoneKey = `ratelimit:otp:phone:${phoneNumber}`;
const ipAttempts = await redis.incr(ipKey);
if (ipAttempts === 1) await redis.expire(ipKey, 3600); // 1 hour window
if (ipAttempts > 5) return false; // Max 5 SMS requests per IP per hour
const phoneAttempts = await redis.incr(phoneKey);
if (phoneAttempts === 1) await redis.expire(phoneKey, 90); // 90 second cooldown
if (phoneAttempts > 1) return false;
return true;
} Biometric FIDO2 Passkey Fallback: By configuring WebAuthn passkeys as the primary registration option, enterprise mobile applications eliminate SMS carrier fees entirely for over 75% of returning users, preserving carrier SMS budgets exclusively for legacy feature phone fallbacks.