Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and the sms session id (8 digits). User then should verify that sms session id in sms matches one in web site UI and only then enter the OTP. If sms session id does not match, user should stop and avoid entering OTP.
Wondering is this kind of workflow made for security reasons? And verification of sms session id protects from some kind of attacks?
One example of such workflow: webmoney.ru