This is where the interpretation of the statement comes into play. It's certainly commonplace throughout the wireless carrier industry to send the mobile number

This is where the interpretation of the statement comes into play. It's certainly commonplace throughout the wireless carrier industry to send the mobile number to "trusted sites" within the carrier network (such as a ringtone/download portal), or over a pre-arranged VPN tunnel. And when I say "commonplace", I'm referring to multiple carriers around the world, including North America. However, the level of trust that a site qualifies for may necessitate a more nuanced or out-of-band approach similar to what you've experienced, where a 3rd party partner may receive the scrambled identifier and request the mobile number mapping for billing purposes. There are lots of ways to skin a cat. My only point here is that there are multiple carriers around the world that routinely use this method of sending the mobile number in plaintext to sites they trust, typically over communication channels that they trust (i.e. over network gear they either own or have secured). I've seen this from both sides (working at and with carriers). But there are a heck of a lot more 3rd party partner sites that do not usually receive full mobile numbers in the clear, so from that perspective, there is a point to be said about this not being "industry practice". Semantics.