Malicious bots have gotten sophisticated enough that SMS verification and velocity controls are one of the few ways to manage Sybil attacks. Device and IP based systems can’t cope with the onslaught.
We really need some smart card cryptographic mechanisms for those without a smart phone, similar to Estonia’s smart card digital ID system. Asking everyone to have a smart phone to be identity proofed is simply not reasonable.
The bad actors do buy SIM cards in large quantities and there are services that will rent out the numbers for SMS verification. It substantially raises the cost for someone that wants to register 100,000 fraudulent accounts without linking accounts based on phone numbers.
Comments
Malicious bots have gotten sophisticated enough that SMS verification and velocity controls are one of the few ways to manage Sybil attacks. Device and IP based systems can’t cope with the onslaught.
We really need some smart card cryptographic mechanisms for those without a smart phone, similar to Estonia’s smart card digital ID system. Asking everyone to have a smart phone to be identity proofed is simply not reasonable.
I’ve always assumed bad actors buy SIM cards and mobile numbers in huge quantities. Isnt that a lot cheaper than having to buy devices?
Regardless, requiring phone numbers impacts a lot of real customers in a negative way.
The bad actors do buy SIM cards in large quantities and there are services that will rent out the numbers for SMS verification. It substantially raises the cost for someone that wants to register 100,000 fraudulent accounts without linking accounts based on phone numbers.