tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received upon requesting it came from your number. That would be impossible, right? That's what happened here, except it wasn't between two friends in this case, but between me and a complete stranger.
Original post:
I have a Google account, and for various reasons, I decided to activate 2-factor authentication (2FA) for my account (i.e., input your password, and confirm the login by typing in a 6 digit code sent to your registered mobile phone number). I did this about a month and a half ago.
The first few codes I received came from a sender identified as "Google" by my phone/service provider. Then, on the 21st of January 2020, I received the 2FA code from a mobile number, when I tried to log in. At that time, I didn't think much about it. I just presumed that Google was probably using a couple of additional numbers and whatnot as backups when there were too many 2FA codes to be sent out or whatever. However, I did retain the SMS, as I was surprised to receive it from what was clearly a regular mobile phone number.
Since then, every single 2FA code I've received has been sent by "Google", and I've never received another code from a mobile number of any sort (or for that matter, from a sender with an identifiable number). Being a bit curious, I called that random number from which I had received the code then, and much to my surprise, somebody actually answered.
They seemed equally surprised by the fact that I had received a 2FA code from their number, and were utterly confused. They gave me their first name and location, and told me I could find them on WhatsApp (which I couldn't; I tried using another person's phone to try and find them on WhatsApp, but that didn't work either).
I am really confused now, and I thought I'd turn to the SE community for some inputs.
Some information that might be pertinent in this discussion:
All the "regular" 2FA code messages are always in English (here's the newest one here; I always delete the messages once I use the code, which is why I don't have a history here).
The errant code I received was in German (I live in Germany, the sender's number is also a German number; the person I spoke with confirmed it by stating where they lived). The person told me that they use Google (Gmail?) as well. A text I sent them (after we spoke) asking if they are actually reachable on WhatsApp can also be seen in the screenshot below (I haven't received a response as of the time of writing).
The errant code worked. I had logged in successfully with it, which is what surprised me the most.
I received a "Critical Security Alert" from Google on the 19th of November 2019: "Google noticed unusual activity in your account. Someone else might have signed in and deleted emails. Review your account activity to make sure no one else has access." However, as far as I could tell, I did not lose any data, and I did not see any suspicious activity either, and this was long before I even activated 2FA anyway.
I don't see anything unusual in the Google Accounts Security page.
As far as I know, none of my accounts (with Google or elsewhere) have been compromised.
If it helps, I use Ubuntu 18.04 on a Lenovo Thinkpad X230 at home (and another Ubuntu 18.04 machine at work). My phone is a ZTE Axon 7 running Android v.7.1.1 (there is no way for me to update it!). I can provide a list of apps and the likes if that will be helpful.
My question is: what is going on? Is it possible for a 2FA code to be sent like this?
