[from]

The numbers are most of the time not premium in the 1-900 sense of the word. They can just appear to be regular mobile or landline numbers in another country and would not be picked up by that library, at least not reliably. There are databases that track some of these numbers but they are usually sold to telcos and are pretty expensive. The only solution is rate limits per number, per IP, and set a max price per SMS of $0.05-$0.10 or so (make your Papua New Guinea users use an Authenticator app instead).

[csharpminor]

IMO WhatsApp is also a great option for 2FA in many countries. OTP is one of the approved outbound templates that WA will let you deliver without an inbound message.