I suppose we do not need to worry about roaming SMS, as roaming voice call charges are usually large enough to negate any benefit you'd get by callback.
As for the format:
1. We could use the from/caller ID to identify initiating mobile. We could then restrict username to a registered mobile number.
2. So keeping it simple, the actual SMS could just be:
callback [from] [to]
eg. callback 004412345678 004412345679
Would be good to be able to specify different source and destination numbers, instead of being limited to the mobile - although may be bit of a risk.
could be reduced by adding
[username] [pin] callback [from] [to]
and matching the source mobile number with that pre-registered..
just an idea.