Twilio’s toll fraud problem
We've been hit by this at work as well. We had to add CAPTCHA and a several other techniques to defend against this.How it works:  1.  Attacker leases 1 or more premium rate numbers in an international country.
      - Attacker can lease a premium rate number for as little as $10/month
      - Typically, the attacker gets to keep 70% of the money generated by the premium rate number.

  2. Attacker then finds companies with OTP (One-Time Passcodes) or 2FA (Two-Factor Authentication) endpoints that require no validation and writes a script to automate the webpage or call the API endpoint
     - Attacker will typically obtain a new IP address per API call using a VPN or a rented botnet from the dark web.

  3. If the premium rate number costs 10 cents, then each successful text message they can send to the number generates 7 cents for them.

  4. The attacker then just needs to send 150 SMS to the premium rate number to break-even on their $10 investment, not counting the cost of the VPN or rented botnet.

There is a lot of money to be made here by an attacker unfortunately. :(