2

I recently encountered a strange incident regarding the 2FA of my Google Account.

The user Dunois has described a very similar occurrence in this post: Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number

My experience is a bit different, in the the code itself is also suspicious.

The other day, I set up 2FA for the Google Workspace Account that I use at work. I (foolishly) chose the SMS option, and entered my phone number. The code that I received didn't come from the usual phone number simply marked as "Google", but from what appeared to be a regular phone number from the UK (+447907180..., apparently an O2 number). Also it didn't come with the usual message ("G-###### is your...), it simply had six digits in it, with no further message.

I didn't use the code, because it just freaked me out a bit. Instead I requested another code, this time receiving a message from the usual "Google" number. I had not switched websites, I literally clicked the same button twice, receiving messages from two different numbers. I can also rule out falling for a spoofed website, since I've navigated to my account settings from my Gmail, which I have saved as a bookmark in my browser.

The next day, I tried to reproduce the same thing with my private Google account, which already had 2FA activated. When I switched it to SMS, the same thing happened again:

enter image description here

This time the code came from a German number (I live in Germany), but had the same format as the last one. Again though, I didn't enter the code. On both accounts I haven't been able to receive another message from the two numbers since. Every time I request a new code, it will come from the old "Google" number. Friends that tried it for themselves were getting the regular messages as well.

My Google account shows no suspicious activity, I am not missing any data, nor have I been locked out of either my accounts.

I called both numbers, the German one seems to be active, but goes straight to voicemail. The British one is apparently unknown by my provider T-Mobile.

So my question is: Do I have to worry about my account? And if not, what is going on here? If it is a scam of some sort, where's the scam? Could this be some strange glitch on Google's side? Has Google just used some third party 2FA service provider to send me the message? And if so, why would they settle for a company that make their messages look like strange phishing attempts?

3
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Commented Nov 29, 2020 at 14:53
  • @LvB Sort of, but not all the way. In my example the SMS didn't contain any message at all, just the code. In the linked thread User Martin Schröder mentions, that this will most likely be the making of an sms aggregator used by the company. I spoke to Google in the meantime and they told me the same thing: an error with the aggregator. Though they wouldn't tell me who this aggregator is, what type of numbers this could be and why Google would employ a company, that make their messages look lile phishing attempts
    – marlon
    Commented Dec 9, 2020 at 9:59
  • Google does not operate a sms gateway themselves, they buy in this service (the aggregator). These gateways need a service contract and delivery point for all networks they support,so there quite a lot of companies using the same set of gateways.
    – LvB
    Commented Dec 9, 2020 at 10:03

0

Browse other questions tagged .