This is built in to SMS and is implemented in the Protocol Identifier (TP-PID):
For MT short messages, on receipt of a short message from from the SC,
the MS shall check to see if the associated Protocol Identifier
contains a Replace Short Message Type code.
If such a code is present, the the MS will check the originating
address and replace any existing stored message having the same
Protocol Identifier code and originating address with the new short
message and other parameter values. If there is no message to be
replaced, the MS shall store the message in the normal way. The MS may
also check the SC address as well as the Originating Address. However,
in a network which has multiple SCs, it is possible for a Replace
Message type for a SM to be sent via different SCs and so it is
recommended that the SC address should not be checked by the MS unless
the application specifically requires such a check.
If a Replace Short Message Type code is not present then the MS will
will store the message in the normal way.
In the SMPP protocol specification this is REPLACE_SM:
This command is issued by the ESME to replace a previously submitted
short message that isstill pending delivery. The matching mechanism is
based on the message_id and source addressof the original
message.Where the original submit_sm ‘source address’ was defaulted
to NULL, then the source addressin the replace_sm command should also
And in EMI this is Type of Service 08, code 01:
This Type of Service requests to replace a previously submitted
message. It is only present when an update is requested. By default a
message is assumed to be a new message.
The reason that this exists is so that services that send lots of SMS messages can avoid consuming the mobile phone's memory. There is no security built in as far as I know; if you can spoof the source id, then you can tell the phone to overwrite previous messages from that same source.