Does this involve collusion with the telco? IIRC There's a fair amount of baseband-layer stuff that can be done with SMS from a trusted party.