/
Contact usSee pricingStart building
Node
​

    About Stytch

    Introduction
    Integration Approaches
      Full-stack overview
      Frontend (pre-built UI)
      Frontend (headless)
      Backend
    Migrations
      Migration overview
      Migrating users statically
      Migrating users dynamically
      Additional migration considerations
      Zero-downtime deployment
      Defining external IDs for users
      Exporting from Stytch
    Custom Domains
      Overview

    Authentication

    DFP Protected Auth
      Overview
      Setting up DFP Protected Auth
      Handling challenges
    Magic Links
    • Email Magic Links

      • Getting started with the API
        Getting started with the SDK
        Replacing your password reset flow
        Building an invite user flow
        Add magic links to an existing auth flow
        Adding PKCE to a Magic Link flow
        Magic Link redirect routing
    • Embeddable Magic Links

      • Getting started with the API
    MFA
      Overview
      Backend integration
      Frontend integration
    Mobile Biometrics
      Overview
    M2M Authentication
      Authenticate an M2M Client
      Rotate client secrets
      Import M2M Clients from Auth0
    OAuth
    • Identity providers

      • Overview
        Provider setup
      Getting started with the API (Google)
      Add Google One Tap via the SDK
      Email address behavior
      Adding PKCE to an OAuth flow
    Connected AppsBeta
      Setting up Connected Apps
    • Integration Guides

      • Integrate with AI agents
        Integrate with MCP servers
        Integrate with CLI Apps
    • Resources

      • About Remote MCP Servers
    Passcodes
      Getting started with the API
      Getting started with the SDK
    • Toll fraud

      • What is SMS toll fraud?
        How you can prevent toll fraud
      Unsupported countries
    Passkeys & WebAuthn
    • Passkeys

      • Passkeys overview
        Set up Passkeys with the frontend SDK
    • WebAuthn

      • Getting started with the API
        Getting started with the SDK
    Passwords
      Getting started with the API
      Getting started with the SDK
      Password strength policy
    • Email verification

      • Overview
        Email verification before password creation
        Email verification after password creation
    Sessions
      How to use sessions
      Backend integrations
      Frontend integrations
      Custom claims
      Custom claim templates
      Session tokens vs JWTs
      How to use Stytch JWTs
    TOTP
      Getting started with the API
      Getting started with the SDK
    Web3
      Getting started with the API
      Getting started with the SDK

    Authorization

    Implement RBAC with metadata

    3rd Party Integrations

    Planetscale
    Supabase
    Feathery
    Unit

    Testing

    E2E testing
    Sandbox values
Get support on SlackVisit our developer forum

Contact us

Consumer Authentication

/

Guides

/

Authentication

/

Passcodes

/

Toll fraud

/

How you can prevent toll fraud

How you can prevent toll fraud

While Stytch offers built-in protections, we highly recommend that apps that use SMS OTPs take additional steps to protect SMS endpoints.

Restrict your UI to specific geographies in which you operate

  • SMS to phone numbers outside of the US and Canada is disabled by default for customers who did not use SMS prior to October 2023 (if you're interested in sending international SMS, please reach out to support@stytch.com, and we can enable it for you).
  • If your Stytch Workspace is enabled for international SMS:
    • If your company plans to primarily operate in only a few geographies, consider configuring your UI or phone number validation to limit SMS logins to core geographies.
    • If you’re using our Backend SDKs, create an allowlist in your backend for phone number prefixes. See our T3 example app for a complete example. Below are the relevant code blocks:
// utils/phone-countries.ts
import { Country } from 'react-phone-number-input';

/**
 * This list is used to populate the country dropdown on the phone number input
 * in the login form. Simply remove any countries that you don't want to support. You may
 * want to limit support due to cost, fraud, or because you do not do business in that country.
 **/

export const STYTCH_SUPPORTED_SMS_COUNTRIES: Country[] = [
  'US', // will be selected by default on phone number input
  'CA',
];
// components/PhoneInput.tsx
import { STYTCH_SUPPORTED_SMS_COUNTRIES } from '~/utils/phone-countries';
import PhoneInputWithCountry from 'react-phone-number-input/react-hook-form';
import flags from 'react-phone-number-input/flags';
// ...other imports

export function PhoneInput(props: { control: Control<{ phone: string }, any> }) {
  const { control } = props;

  return (
    <PhoneInputWithCountry
      style={{...}}
      control={control}
      countries={STYTCH_SUPPORTED_SMS_COUNTRIES}
      countryCallingCodeEditable={false}
      defaultCountry={STYTCH_SUPPORTED_SMS_COUNTRIES[0]}
      flags={flags}
      inputComponent={Input}
      international
      name='phone'
      rules={{ required: true }}
      withCountryCallingCode
    />
  );
}
  • Reach out to support@stytch.com to disable SMS to international numbers for your Stytch Workspace if you do not need access to international SMS, especially if you're using any of our Frontend SDKs and can't enforce country code restriction.

Implement Device Fingerprinting or reCAPTCHA to prevent bots

  • Since most toll fraud attacks are automated, using fraud prevention measures to block/challenge bots or headless browsing can meaningfully mitigate your risk.
  • Stytch offers a device fingerprinting product that can be used to detect and block or challenge bot traffic and bad actors.
  • If you’re using Stytch’s JavaScript SDK, Google reCAPTCHA can be easily implemented using our CAPTCHA guide.

Monitor and configure alerting for common toll fraud indicators

  • Consider setting up alerting for some of the common toll fraud indicators described above, such as abnormally low SMS authentication rates, a spike in SMS quantity or velocity, or SMS logins from unusual geographies.

Use SMS as second factor rather than a primary authentication measure

  • Another approach to limit your risk is to use SMS only as a secondary authentication factor.
  • For example, you can require users to verify their email prior to allowing them to interact with your SMS endpoints.

What to do if you suspect your app is experiencing toll fraud

If you believe your app is actively experiencing toll fraud, in addition to taking action to stop it on your end, please reach out to support@stytch.com so we can help you to mitigate the fraud quickly and effectively.

Restrict your UI to specific geographies in which you operate

Implement Device Fingerprinting or reCAPTCHA to prevent bots

Monitor and configure alerting for common toll fraud indicators

Use SMS as second factor rather than a primary authentication measure

What to do if you suspect your app is experiencing toll fraud