I used to (haven't tested in 2 years) be able to spoof AT&T cell phone numbers, and call the same number you are spoofing and listen to voicemails if they didn't have a PIN assigned. Seems like they only authenticated based on CID.