If you can settle for 2G IMSI-catching, there are some old femtocells with SIP backhaul that could be hackable enough. Someone once tried to build a "roam-to-voip-at-home" kind of service out of those. It was just SIP VoIP backhaul without protection preventing spoofing the backhaul network. I can't recall the company but I think they pivoted to shipboard phone service.