It doesn't have to be that complicated. Consider, for example, the credit card pre-authorization hotels perform when you check into a hotel, to ensure you can pay for incidental expenses (room service, mini bar, etc).

One can easily imagine doing something similar at signup time for postpaid services like Twilio (or any other abusable SaaS, for that matter).