That’s not the real problem.
The part of your phone managing communications is a black box for you, the user. It is designed to be that way, so that hackers will not tamper with it and turn it to unlicensed bands or else. Security by obscurity. But it is not a black box for the cell tower and its security is rather low. The consequence is that, when you control the tower, you can usually install trojans on a phone. The trojan, in turn, will send data to its master. Any data.
And, as I said, fake base stations are becoming more common, because they can be emulated in software. That is the beauty of SDR (software defined radio): with a relatively cheap adapter and the correct software one can emulate a wealth of radio protocols. I gave the link to a solution using a 5$ USB to VGA adapter, but there are better solution like the hackRF board. Look it up. It works very well: with one of these, anybody can build his own stinger in his garage. The code is freely downloadable.
The network operators will find out quickly, because you will be operating an unlicensed transmitter right in their bands. But not quickly enough for a prepared hacker to do their deeds and run.
