According to the GSM Standards ALL Mobile Originated (MO) USSD requests to Service Codes in the range *100# to *499# must be routed to the originator's home HLR. (Requests to code *500# and above can in theory be handled by the VLR of the visited network and routed to a local USSD Gateway, enabling operators to, in theory, offer USSD services to in-roamers. However, this is rarely done.)
Upon receiving an MO request, the HLR should validate that the subscriber is active in its records and that the service code is valid and active. If those checks pass, the HLR should route the request via a USSD Gateway to the appropriate application. Only when that application responds positively to the request can a USSD session be established. Once a session is established between these parties then transactions can flow end to end.
The application that receives the request may perform its own validation during the session, eg. verifying the IMSI of the requestor or performing multi-phase authentication.
However, it could be possible for someone to sniff on the radio interface or to hi-jack it entirely (ala Paget) and record these inputs for subsequent fraudulent use.
Many USSD-based financial services use end-to-end encryption between a client (SIM toolkit or Java) on the handset and the application attached to the USSD Gateway. This is the only way of guaranteeing the security of such services.
Network Initiated (NI) USSD poses a greater risk in that it can originate from outside the home network. In this case a USSD session is pushed to a subscriber's handset and may appear as if it is coming from their home network. For this reason many MNOs block NI USSD coming from outside the network but this is not effective when their subscribers roam out.
While roaming in a foreign network, a subscriber may see an advert promising a cool service if they send SMS to an international MSISDN. When they send the SMS, a USSD session may be pushed to their handset.
Such a session may not have any sinister purpose but it is not within the control of the recipient's home operator.