Text message codes at sign-up for a scooter app

Your scooter rental app runs in 3 countries. To sign up, a person types a phone number, and you text them a 6-digit code to type back. Your text provider charges per message: about $0.01 to numbers in your 3 countries, and up to $0.40 elsewhere.

On a normal day you send about 20,000 codes, and about 80% are typed back. About 3% go to numbers from other countries, mostly visitors. Last Saturday you sent 600,000 codes, mostly to numbers in 5 countries where you have no scooters, and the day's bill was $90,000. The requests came from thousands of IP addresses.

What do you check before sending a code, and what keeps another Saturday from costing that much?