If it's anything like the systems I've come across, there is a proxy server on the mobile data network with a whitelist of either IPs or URL patterns that will

If it's anything like the systems I've come across, there is a proxy server on the mobile data network with a whitelist of either IPs or URL patterns that will have the number added as a HTTP header ("header enrichment"), then the endpoints (so the third party systems) must be configured to only accept this header from the IP range of the proxies, so that should avoid spoofing if correctly configured. I'd have thought this IP restriction requirement would be part of the contract they'd have to sign to get the data.