This question already has an answer here:
How to secure SMS sending feature in web applications? If an application is using third party SMS gateway then SMS also can be spoofed. Like attacker can change mobile number with firebug and abuse SMS gateway to send spoof SMS like phishing message to the victim. How we can secure web application from this attack?