I have several Google verification codes sent from an account called "Google" and also some other Google verification code received that were sent from four different phone numbers. Do Google use multiple different phone lines for sending out verification codes? How can I tell whether these codes are actually sent from Google?
How can I tell whether these codes are actually sent from Google?
I can now send you a code from any number/any name I want and you would probably believe it came from Google.
When you try to input the code I sent you to the 2FA it will not work verifying that I am indeed not Google.
EDIT: For anyone reading this in 2020 Googles stock Android sms app(Messages) will now verify who the message is from. If it doesn't say that it is from Google I would suggest that you don't use it and request a new code. Or don't login to that account until things are figured out.
Do Google use multiple different phone lines for sending out verification codes
Google probably uses a 3rd party service for sending the SMS. Even if they didn't, in order to scale they would need multiple lines since most carriers have SMS limits.
Mobile communication in GSM, UMTS and LTE is done according to 3GPP.
The TP-OA field in SMS-DELIVER TPDU in an incoming SMS typically contains the number of a sender, but can also contain an alpha-numerical field, because the MAP protocol (the one used for sending SMS messages among others) allow specifying either a phone number or an alpha-numeric value as the sender.
Normal phones will not allow switching from number to alpha-numerical; they will set the number as default.
But in case of a company name, like Google, Adobe, etc (that have SMS centers), TP-OA can be made alpha-numeric using the Type of Number Information Element as 7-bit default alphabet.
You can find the specs and details in 3GPP TS 24.011 and 23.040.
Therefore, in the case you stated, if the company decided not to use a number in the proper field, you will not be able, from your end, to determine what number actually sent that message that had an alpha-numeric field.
Google uses voip services. They have a "pool" of available phone numbers to send you messages from, thus you will have a difficult time finding out if the number is actually google. However, there are reverse phone number lookup services out there that may be of assistance to you; just google it.
For reference, usually google verification codes show up with "G-######" and only show up when you login to a google service from unrecognized location/machine/or if you have 2fa enabled. Hope this helps!