diff --git a/policies/signup-signin-with-phone-number/README.md b/policies/signup-signin-with-phone-number/README.md
index 8b4a8f30..52644f20 100644
--- a/policies/signup-signin-with-phone-number/README.md
+++ b/policies/signup-signin-with-phone-number/README.md
@@ -1,5 +1,45 @@
# A B2C IEF Custom Policy which allows login via Phone Number (OTP)
+## ⚠️ Security Warning — SMS Toll Fraud (IRSF)
+
+**Before deploying phone-based authentication in production, implement SMS toll fraud mitigations.**
+
+Azure AD B2C phone-based authentication sends SMS to all supported countries by default without built-in geo-restriction or spending caps. This creates exposure to [International Revenue Share Fraud (IRSF)](https://en.wikipedia.org/wiki/International_revenue_share_fraud), where attackers programmatically trigger SMS OTP deliveries to premium-rate numbers, generating significant costs.
+
+**Recommended mitigations:**
+
+1. **Restrict country codes** — Use the `countryList` allow-list to limit SMS to countries where your users are located. A ready-to-paste snippet is provided below.
+2. **Enable CAPTCHA** — [Add CAPTCHA to sign-up and sign-in](https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-captcha) to prevent automated attacks.
+3. **Conditional Access** — [Block sign-ins based on location](https://learn.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-user-flow).
+4. **Monitor** — Use the [Azure Monitor workbook for phone authentication failures](https://learn.microsoft.com/en-us/azure/active-directory-b2c/phone-based-mfa) to detect anomalies.
+
+👉 Full mitigation guide: [Phone-based MFA — Mitigate fraudulent sign-ups for custom policy](https://learn.microsoft.com/en-us/azure/active-directory-b2c/phone-based-mfa#mitigate-fraudulent-sign-ups-for-custom-policy)
+
+### `countryList` allow-list — now enforced out-of-the-box
+
+This sample now ships with a **Nordic-only allow-list** (`NO`, `SE`, `DK`, `FI`, + `IS` / `FO` / `AX` on the Nordic localizations). All other country codes are blocked at the UX layer — SMS cannot be triggered to them.
+
+The enforcement lives in **two places**, both edited in this PR:
+
+1. **[`policy/TrustFrameworkLocalization.xml`](policy/TrustFrameworkLocalization.xml)** — `countryList` in the `api.phonefactor.sv` and `api.phonefactor.nb` `LocalizedResources`. The previous full world list (~240 countries) has been split into two commented reference tiers right below the active allow-list:
+ - ⚠️ **HIGH-RISK (IRSF / SMS-pumping hotspots)** — must not be uncommented without complementary controls (CAPTCHA, Conditional Access, Azure Monitor anomaly alerts, per-tenant SMS spending cap).
+ - Lower-risk (OECD / EU / major commercial markets) — still review before enabling.
+
+2. **[`policy/phone-signup-signin.xml`](policy/phone-signup-signin.xml)** — a new `BuildingBlocks > Localization` block at the top of the relying party policy adds the same Nordic allow-list for the default English UX path, alongside a prepended `api.phonefactor` `ContentDefinition` that wires in `api.phonefactor.en`.
+
+### Action required before production
+
+Extend the `countryList` JSON in both files with the ISO 3166-1 alpha-2 codes of the countries where your users are. **Do not paste a global list** — each entry opens an SMS egress path that an attacker can pivot to.
+
+```xml
+
+
+```
+
+Apply the same edit to the `api.phonefactor.sv` and `api.phonefactor.nb` entries in `TrustFrameworkLocalization.xml` with localized country names.
+
+---
+
## Updated version notes
This sample has been updated. The previous version is in the zip file [phone_SUSI_old.zip](policy/phone_SUSI_old.zip) for your conveniance.
diff --git a/policies/signup-signin-with-phone-number/policy/TrustFrameworkLocalization.xml b/policies/signup-signin-with-phone-number/policy/TrustFrameworkLocalization.xml
index db3cb9c3..a021c834 100644
--- a/policies/signup-signin-with-phone-number/policy/TrustFrameworkLocalization.xml
+++ b/policies/signup-signin-with-phone-number/policy/TrustFrameworkLocalization.xml
@@ -379,9 +379,70 @@
-
-
-
+
+
+
+
Avbryt
@@ -853,9 +914,70 @@
-
-
-
+
+
+
+
Avbryt
diff --git a/policies/signup-signin-with-phone-number/policy/phone-signup-signin.xml b/policies/signup-signin-with-phone-number/policy/phone-signup-signin.xml
index 801b09b3..169ce572 100644
--- a/policies/signup-signin-with-phone-number/policy/phone-signup-signin.xml
+++ b/policies/signup-signin-with-phone-number/policy/phone-signup-signin.xml
@@ -19,6 +19,41 @@
+
+
+
+ ~/tenant/templates/AzureBlue/multifactor-1.0.0.cshtml
+ urn:com:microsoft:aad:b2c:elements:contract:multifactor:1.2.20
+
+ - azureBlue
+
+
+
+
+
+
+
+
+
+ en
+
+
+
+
+
+
+
+
+
+4XXXXXXXX
diff --git a/readme.md b/readme.md
index c352684f..6111157b 100644
--- a/readme.md
+++ b/readme.md
@@ -4,6 +4,10 @@
# Azure Active Directory B2C: Custom CIAM User Journeys
+> ## ⚠️ Security Notice — SMS Toll Fraud (IRSF)
+>
+> Samples that use **phone-based authentication** (SMS OTP, voice call) carry financial risk if deployed without fraud mitigations. The [`signup-signin-with-phone-number`](policies/signup-signin-with-phone-number/#️-security-warning--sms-toll-fraud-irsf) sample has a dedicated security section with a ready-to-paste `countryList` allow-list snippet (the recommended first mitigation), and the [full mitigation guide](https://learn.microsoft.com/en-us/azure/active-directory-b2c/phone-based-mfa#mitigate-fraudulent-sign-ups-for-custom-policy) on Microsoft Learn.
+
In this repo, you will find samples for several enhanced Azure AD B2C Custom CIAM User Journeys.
## Getting started
@@ -109,7 +113,7 @@ Samples are available for the following categories
|Sample name |Description |Quick deploy|
|---|---|---|
|[Password-less sign-in with email verification](policies/passwordless-email)|Password-less authentication is a type of authentication where user doesn't need to sign-in with their password. This is commonly used in B2C scenarios where users use your application infrequently and tend to forget their password. This sample policy demonstrates how to allow user to sign-in, simply by providing and verifying the sign-in email address using OTP code (one time password).|[Go](https://b2ciefsetupapp.azurewebsites.net/Home/Experimental?sampleFolderName=passwordless-email)|
-|[Login with Phone Number](policies/signup-signin-with-phone-number)|An example set of policies for password-less login via Phone Number (SMS or Phone Call).|[Go](https://b2ciefsetupapp.azurewebsites.net/Home/Experimental?sampleFolderName=signup-signin-with-phone-number)|
+|[Login with Phone Number](policies/signup-signin-with-phone-number)|An example set of policies for password-less login via Phone Number (SMS or Phone Call). **Includes SMS toll fraud (IRSF) mitigation guidance — `countryList` allow-list snippet in the sample README.**|[Go](https://b2ciefsetupapp.azurewebsites.net/Home/Experimental?sampleFolderName=signup-signin-with-phone-number)|
## Multi factor