SMS is a dated technology and I despise services that use SMS, especially for OTP / PINs used to sign in. SIM cards can be 'swapped' by bad actors all too easily. I understand you want to stop abuse, but there's other ways to do this like CAPTCHAs or putting your site on Cloudflare and filtering out rogue/malicious IPs like VPNs/Tor, or doing things like rate-limiting.