Only allow phone number based lookups from within the smartphone app, not via the API.

Correct me if I'm wrong, but I don't think they have a public API. The API the apps use is was reverse-engineered and exploited.