You can check for real device. You can have rate limiters. You can request e-mail/phone validation before providing a valuable service. I guess depends on the nature of the situation.