A friend of mine had just had the following happen:
- He visited a website with the mobile phone using Chrome Mobile on Android
- An advertisment poped up that covered the whole page
- There was no close button, and while scrolling the ad, he might have clicked a button
- Immediately afterwards, he received an SMS from droidboost that he will be charged 4,99€ for an abo of droidboost.
Notice how there's only a single user interaction there, clicking the button. (Reportedly, he only scrolled, but I can't eleminate the possibility that he might have accidently clicked a button as well, since accidently taping on the touchscreen can happen easily)
I have already checked with http://headers.cloxy.net that the mobile device is not sending its phone number in the request headers either.