Recently, an unknown attacker started abusing our iOS app’s Firebase Phone auth by spamming requests to Google.cloud.identitytoolkit.v1.AuthenticationService.SendVerificationCode with various phone numbers from different IPs. Conseqently, our app loses approximately 200 USD every day.

To my astonishment, Firebase shows itself as totally helpless against the attacks.
AppCheck seems to do nothing (every option that could be enabled was already enabled), and moreover, there is no basic thing as a quota of requests per IP address for the SendVerificationCode calls.

The “support” is useless also. It continues to repeat the cytes from online docs without trying to investigate the case.

I thought that “Blocking functions” could help, but I’ve laughed loud after knowing that they called after the SMS was already send, so they can’t prevent abuse in my case.

So, the main question to the community is: Guys, how do you protect your Firebase Phone Auth from abuse? Or is it better to leave it alone and migrate to any alternative service?

Regards,