Slide 24 of 28
Part 4 · PreventionSlide 24
Slide 24 · Mitigation 6
MIT 06
Require phone or email verification before high-value business flows.

Real people have a finite number of verified identities. Bots can create unlimited email addresses (disposable email services) but have a harder time with phone numbers at scale. Phone numbers require real SIM cards or purchased virtual numbers — each with a cost. Require phone verification before:

• Participating in limited-release sales or ticket presales

• Receiving referral rewards (verify both referrer and referred)

• Booking appointments or reservations

• Creating accounts that will be used for competitive or high-value actions

Virtual phone numbers for SMS verification exist but cost $0.10–$2.00 each. At scale (1,000 accounts), that’s $100–$2,000 just for phone numbers — before any other bot infrastructure cost. This raises the floor for referral fraud. If each fake referral costs $2 to set up and pays out $20, the fraud margin is still positive — but block those virtual number prefixes and the economics change.

Enforce: one phone number = one verified account = one presale slot. If the same phone number attempts to register more than one presale account, reject the second registration. This is the strongest per-identity control available without requiring government ID.

Every verification step adds friction for legitimate users. Some percentage of real users will abandon the flow when asked to verify their phone number. This is a real cost that must be weighed against the fraud cost. High-value, scarce-inventory flows justify high friction; low-value flows may not.

💼 Business takeaway

Ask your team whether high-value actions — purchase completion, referral credit — require the user to complete prior steps in sequence, or whether those final steps can be called directly. Skipping the funnel is a common abuse pattern.

← Back MIT 07: Business metric monitoring →