Surly this is hugely open to abuse. I could curl requests at a O2 partners site to purchase a ringtone and pass along any O2 number I like, setting the aforementioned headers. Unless the partner site does some sort of extra verification (I have seen no mention of this anywhere), then the O2 number I use will run up a massive bill... Have I missed something?