I wonder how a hypothetical 'bugged' phone would do the data transmissions? I used to have a phone on a contract that had excessively high data charges. As a re

I wonder how a hypothetical 'bugged' phone would do the data transmissions? I used to have a phone on a contract that had excessively high data charges. As a result, I only used it for voice / SMS. If a bug had been planted on it, and it used normal IP networking, it would be obvious when I got my bill. I wonder if there are ways that a pwned phone could transmit to an attacker without hitting the billing system? Non-billed SMS? Or are there other techniques on GSM? (e.g. network operator updates get pushed to phones and they aren't billed; there must be some other low-level two-way messaging capabilities)