0

I have several Google verification codes sent from an account called "Google" and also some other Google verification code received that were sent from four different phone numbers. Do Google use multiple different phone lines for sending out verification codes? How can I tell whether these codes are actually sent from Google?

  • 3
    It's easy to spoof phone numbers...so the only way you can tell (I presume) is the timing of it. If it's someone dodgy sending you a code, it wouldn't work anyway. – Arlix Nov 20 '17 at 11:50
  • Yeah, while it's hard to tell if a code comes from Google or not, I don't think it would be of much value for an attacker to send faked codes. – Anders Nov 20 '17 at 11:54
  • How many codes did you get? Did you request any of these? Do you use your phone number for one or several (if this is even possible) google accounts? Provide some more info. As to how to prove that it really is from google. I doubt that there is an official "range" of telephone numbers that google uses (they probably use more than one). As for the text: just request a security code now and then you'll at least see how the message syntax should look like. – Tom K. Nov 20 '17 at 12:04
  • I received one code per different telephone number. Three from my own country and one from Greece. The syntax and timing of the messages were just as I would expect from messages sent from Google and the codes did work. – Kevin O'Shaughnessy Nov 20 '17 at 12:45
2

How can I tell whether these codes are actually sent from Google?

You can't.

I can now send you a code from any number/any name I want and you would probably believe it came from Google.

When you try to input the code I sent you to the 2FA it will not work verifying that I am indeed not Google.

Do Google use multiple different phone lines for sending out verification codes

Google probably uses a 3rd party service for sending the SMS. Even if they didn't, in order to scale they would need multiple lines since most carriers have SMS limits.

  • I would also add, that if it was possible to precompute a list of all possible known Google numbers, it would make spoofing Google for other purposes easier. It's in everyone's interest for there not to be an exhaustive list of known numbers. – ISMSDEV Nov 20 '17 at 12:56
0

Google uses voip services. They have a "pool" of available phone numbers to send you messages from, thus you will have a difficult time finding out if the number is actually google. However, there are reverse phone number lookup services out there that may be of assistance to you; just google it.

For reference, usually google verification codes show up with "G-######" and only show up when you login to a google service from unrecognized location/machine/or if you have 2fa enabled. Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.