I dug through the literature again, and there are several systems: some using USSD exclusively, others using SIM applications that apparently employ both USSD a

I dug through the literature again, and there are several systems: some using USSD exclusively, others using SIM applications that apparently employ both USSD and SMS for communication. In all case there's some amount of authentication going on, and they all allow retrofitting additional lines of defenses if necessary. 2FA SMS is helpless as long as it's layered on top of plain old SMS (which for political reasons won't become secure).