If a free trial, a referral credit or a new-account promotion is being drained on your product, the highest-value change costs $0.008 per signup: a line type lookup that tells you whether the phone number your user just verified is a mobile, a landline or a non-fixed VoIP number. It will not stop a determined attacker. It will separate the traffic worth spending your remaining budget on from the traffic that is not, and it does that before you have bought anything.
The reason to revisit this now is that the assumption underneath SMS verification has quietly stopped holding. Infosecurity Magazine, reporting on research published on 28 July 2026 by HUMAN Security's Satori Threat Intelligence and Research Team, describes a commercial phone-farm ecosystem the researchers call FunFoneFarm, put at an estimated $2,790 per month to run, with orchestration software that "enables a single operator to control a fleet of devices" and an AI layer that writes the automation scripts. We could not open the underlying report, so treat those figures as reported rather than verified. The directional point does not depend on the exact number: an SMS code has always proved that somebody controls a phone number, and controlling phone numbers at volume is now a line item rather than an obstacle.
Rank your controls by what they cost each side
The useful way to choose is not accuracy, which nobody publishes honestly. It is asymmetry: what does this cost you per attempt, and what does it cost an attacker to get past it. Prices below are from the vendors' own pricing and documentation pages, opened 30 July 2026. The right-hand column is our assessment, not the vendors'.
| Control | Your cost | What it catches | How it is beaten |
|---|---|---|---|
| Cloudflare Turnstile, managed mode | Free tier: up to 20 widgets, unlimited challenges, 10 hostnames per widget | Naive scripted submissions against your form | A real browser driven by a real device, which is precisely what a phone farm is |
| Twilio Lookup, formatting and validation | Free | Numbers that are malformed or do not exist | Any working number |
| Twilio Lookup, Line Type Intelligence | $0.008 per request | Non-fixed VoIP, toll free, landline where you expected mobile | Real SIMs in real handsets |
| Twilio Lookup, SMS Pumping Risk Score | Free in NAMER, $0.025 elsewhere | Traffic pumping that inflates your own SMS bill | Not a signup control; it protects your spend |
| Twilio Lookup, Reassigned Number Risk | $0.02 per query for the first 1,000, down to $0.0015 above 6 million | Numbers that changed hands since you first saw them | Fresh numbers |
| Twilio Lookup, Identity Match | $0.1 per request, varies by country | A name and number that do not belong together | Stolen identity data, which is cheap |
| Stripe Radar rules | Included with your Stripe account at the rule level | Abuse that touches money: prepaid cards, disposable email, card velocity | Real cards, which raises the attacker's cost sharply |
Read the bottom row against the rest. Every control above it is cheap for you and cheap to defeat. The moment a signup has to be backed by a real payment card, the attacker's unit economics change, because a card leaves a trail and can be charged back against them.
What this costs at 10,000 signups a month
Our arithmetic, on the published prices above. Assume 10,000 signups a month and a policy of escalating rather than blocking.
- Turnstile on the signup form: $0.
- Line Type Intelligence on every signup: 10,000 × $0.008 = $80.
- Identity Match on the 5% that come back non-fixed VoIP or otherwise odd: 500 × $0.10 = $50.
- Total: $130 a month, of which $80 is unconditional.
It is tempting to set that against the $2,790 monthly figure in the HUMAN reporting and declare a win. Do not: that figure describes one operation attacking many targets, not the cost of attacking you specifically, and the comparison is not like for like. The useful conclusion is narrower. $130 a month is small enough that the decision is not really a budget question, and if you are running no signup checks at all today, the thing stopping you is that nobody has owned the task.
The order to layer them
First, Turnstile in managed mode. Cloudflare's documentation describes managed mode as automatically deciding whether to show a checkbox based on visitor risk, and the widget can be embedded without routing your site through Cloudflare at all. The free plan, per its plans page, allows up to 20 widgets, unlimited verification requests and 10 hostnames per widget, with 7 days of analytics lookback. If you run a single-page app, use pre-clearance so the challenge issues a cookie rather than firing on every route.
Second, free validation, then paid enrichment. Twilio's Lookup pricing makes formatting and validation free, so there is no reason to send an SMS to a number you already know is invalid. Line Type Intelligence at $0.008 returns mobile, landline, fixed VoIP, non-fixed VoIP, toll free and more.
Third, do not block on line type. This is where most teams get it wrong and generate support tickets. Plenty of legitimate customers use a non-fixed VoIP number as their main line. Use the signal to route: a mobile number goes straight through, a non-fixed VoIP number gets a lower trial limit, no referral credit until first payment, and a manual look if it converts oddly. Friction, not refusal.
Fourth, connect the signal to the money. Stripe's Radar rules support block, review and request 3D Secure as actions, over attributes including :is_disposable_email:, :card_funding:, :card_country:, :risk_level:, :seconds_since_card_first_seen: and custom metadata written as ::key::. Stripe's own documented examples include:
Request 3D Secure if :risk_level: != 'normal' and :amount_in_usd: > 25
Block if :card_country: != 'US' and :risk_level: = 'elevated'The metadata syntax is the part worth building on. Write the line type you looked up at signup into the customer's metadata, then let Radar act on it later, when the same person tries to pay:
Review if ::signup_line_type:: = 'nonFixedVoip' and :is_disposable_email:That is a rule about a pattern, not about a person: a throwaway number and a throwaway email together, at the point money moves. Neither signal alone justifies anything.
Measure the thing before you buy for it
Before any of this, get one number: what abuse actually costs you per month. Trial compute, referral credits paid to accounts that never converted, support hours, and disputes. If that number is $200, a $130 monthly control stack is already close to pointless and the right answer is a product change, such as requiring a card for the trial. If it is $9,000, you have a case for spending real money, and the published dispute economics in our chargeback defence plan are the right frame for deciding how much.
Nothing above comes with a published effectiveness figure, and we have deliberately not quoted one. Anyone who tells you a control stops a specific percentage of fraud is quoting their own marketing. Run yours for a month, count the signups that got routed to friction and how many of those became paying customers, and let that decide the next step. The same discipline applies to traffic you pay for, which is the subject of our invalid traffic routine, and to the involuntary side of churn covered in failed payments.
Three things not to buy first
- Enterprise bot management, while a free Turnstile widget is not yet on your signup form. Start at zero dollars and find out what remains.
- SMS two-factor as your fraud control. It is an account security feature. Treating possession of a number as evidence of a distinct human is the assumption this week's research undermines.
- A fraud platform, before you can state your monthly abuse cost to the nearest hundred dollars. Vendors will happily size the problem for you, and their estimate will not be smaller than their price.
Discussion
Sign in with Google or just a name. No email link, no password to remember.