The Hidden Cost of Phone-Based Auth: What I Learned After 18 Months

We added SMS verification to our app expecting it to be simple. 18 months later, I have opinions about carrier filtering, Twilio bills, and abuse bots. Eighteen months ago, our PM walked into standup and said: "We need phone verification for sign-up. Users are creating fake accounts with disposable emails. Should be a weekend project, right?" It was not a weekend project. What followed was a year and a half of unexpected Twilio invoices, ghost messages eaten by carrier filters, an abuse wave that nearly bankrupted our SMS budget, and a slow realization that phone-based auth is one of those things that looks simple on a whiteboard and gets complicated the moment real humans in real countries try to use it. This isn't a tutorial on how to implement 2FA. There are plenty of those. This is the stuff nobody warned me about. The Twilio Bill That Made Finance Call Me Our app is a B2B SaaS tool — think project management for small agencies. We launched phone verification for sign-up in March 2