If you can settle for 2G IMSI-catching, there are some old femtocells with SIP backhaul that could be hackable enough. Someone once tried to build a &quot;roam-to-voip-at-home&quot; kind of service out of those. It was just SIP VoIP backhaul without protection preventing spoofing the backhaul network. I can&#x27;t recall the company but I think they pivoted to shipboard phone service.