I have several Google verification codes sent from an account called "Google" and also some other Google verification code received that were sent from four different phone numbers. Do Google use multiple different phone lines for sending out verification codes? How can I tell whether these codes are actually sent from Google?
asked Nov 20, 2017 at 11:45
-
3It's easy to spoof phone numbers...so the only way you can tell (I presume) is the timing of it. If it's someone dodgy sending you a code, it wouldn't work anyway.– ArlixNov 20, 2017 at 11:50
-
Yeah, while it's hard to tell if a code comes from Google or not, I don't think it would be of much value for an attacker to send faked codes.– AndersNov 20, 2017 at 11:54
-
How many codes did you get? Did you request any of these? Do you use your phone number for one or several (if this is even possible) google accounts? Provide some more info. As to how to prove that it really is from google. I doubt that there is an official "range" of telephone numbers that google uses (they probably use more than one). As for the text: just request a security code now and then you'll at least see how the message syntax should look like.– Tom K.Nov 20, 2017 at 12:04
-
1I received one code per different telephone number. Three from my own country and one from Greece. The syntax and timing of the messages were just as I would expect from messages sent from Google and the codes did work.– Kevin O'ShaughnessyNov 20, 2017 at 12:45
-
Be aware: These may very well be from Google, but part of a scam nonetheless. Let's say that I know your phone and e-mail: I go to password-reset your account, and I find some way to get those codes from you. You should be safe as long as you (1) only enter codes directly into the websites/services that the codes themselves claim to be from, and (2) only ever divulge codes that you have just recently requested. If either of these conditions doesn't hold, you are at severe risk; if both hold, you're probably safe.– JamesTheAwesomeDudeApr 22, 2021 at 21:42
Add a comment
|
3 Answers
How can I tell whether these codes are actually sent from Google?
You can't.
I can now send you a code from any number/any name I want and you would probably believe it came from Google.
When you try to input the code I sent you to the 2FA it will not work verifying that I am indeed not Google.
EDIT: For anyone reading this in 2020 Googles stock Android sms app(Messages) will now verify who the message is from. If it doesn't say that it is from Google I would suggest that you don't use it and request a new code. Or don't login to that account until things are figured out.
Do Google use multiple different phone lines for sending out verification codes
Google probably uses a 3rd party service for sending the SMS. Even if they didn't, in order to scale they would need multiple lines since most carriers have SMS limits.
answered Nov 20, 2017 at 12:02
-
I would also add, that if it was possible to precompute a list of all possible known Google numbers, it would make spoofing Google for other purposes easier. It's in everyone's interest for there not to be an exhaustive list of known numbers.– ISMSDEVNov 20, 2017 at 12:56
Mobile communication in GSM, UMTS and LTE is done according to 3GPP.
The TP-OA field in SMS-DELIVER TPDU in an incoming SMS typically contains the number of a sender, but can also contain an alpha-numerical field, because the MAP protocol (the one used for sending SMS messages among others) allow specifying either a phone number or an alpha-numeric value as the sender.
Normal phones will not allow switching from number to alpha-numerical; they will set the number as default.
But in case of a company name, like Google, Adobe, etc (that have SMS centers), TP-OA can be made alpha-numeric using the Type of Number Information Element as 7-bit default alphabet.
You can find the specs and details in 3GPP TS 24.011 and 23.040.
Therefore, in the case you stated, if the company decided not to use a number in the proper field, you will not be able, from your end, to determine what number actually sent that message that had an alpha-numeric field.
Google uses voip services. They have a "pool" of available phone numbers to send you messages from, thus you will have a difficult time finding out if the number is actually google. However, there are reverse phone number lookup services out there that may be of assistance to you; just google it.
For reference, usually google verification codes show up with "G-######" and only show up when you login to a google service from unrecognized location/machine/or if you have 2fa enabled. Hope this helps!
