Why many unrequested 6-digit SMS login codes sent to my Nougat Phone?

Question

I have received the following SMS messages from Google within 24H hours where all but one message (first) is not requested by me.
You can note that only the codes sent 23:16 and 23:22 have distinguishing codes. All codes after 00:21 are the same as the first one, indicating that there can be an external process sending those codes, perhaps not even sent by Google or sent by a bug in Google SMS login system process.

123456 Google verification code Yesterday 23:16 (requested only by me)

654321 Google verification code Yesterday 23:22

123456 Google verification code today 00:22

123456 Google verification code today 00:52

123456 Google verification code today 01:22

123456 Google verification code today 13:22

123456 Google verification code today 16:54

123456 Google verification code [today+1] 01:22

123456 Google verification code [today+1] 13:22

[changed gmail password]

234567 Google verification code [today+1] 23:17

[disconnect my Phonenumber1 from email2, only email1 left there; originally, email1-2 primarily to Phonenumber1, but now, both my email1 for Phonenumber1 and email2 for Phonenumber2 without the interconnection]

[... monitoring situation now ...]

In relation to the matter, I could not use sufficiently hardened Gmail account (with Fido U2F keys) in my Android phone because of the reason described in the thread answer here.
Still, those SMS messages should not be sent at all because my security measure is Google prompt in 2-step verification.
So now, I am using a dummy Gmail account which is receiving those verification codes, but which has the same phonenumber connected to it as my main email address so this fact can be a vulnerability somehow.

You note that I keep getting those SMSs, now 3rd day in a row.
I really would like find measures to block them coming.

I have got 01:22 and 13:22 codes many times so indicating periodicity so a likely some software is creating these requests

Oneplus support chat opinion about the case

Thanks for waiting, upon checking that link you sent me, I see that those 6 digit log in codes are Google related issues.
- -
Thanks for waiting, please follow this link contact them
https://gsuite.google.com/support/ - - Try contacting them with this number +1 1800 813 0692

Other observations in the phone

Signal app is also sending me verification codes at the rate 1/day (at 1648, 2316, 0653 and 1648 in 3 days), although I uninstalled it. This fact suggests me a software issue. I cleaned the cache, but not sure if enough.

No such problem with WhatsApp.

Phone: Oneplus 3T

OS: Android 7.1.1 Nougat

Security: 2-step verification by Google prompt

Related Google product forum thread: https://productforums.google.com/forum/#!topic/gmail/mtIbMSGclu4;context-place=forum/gmail

Google product forum help ticket: sent today at about 17:00

Answer

The most likely source of your multiple two-factor confirmation messages is something making multiple attempts to log into Google or Google+. This might be malfunctioning apps on your device, or someone else (accidentally or intentionally) using your Google ID from another device. You should contact Google, who will be able to confirm the device that was used for the login attempts; if it's your phone, you'll want to look at what app might have a wrong stored password, or that would have been closed and reopening (hence relogging) at those times.

If it's not your phone, you'll want to change your Google password immediately: these two-factor codes aren't generated until after someone has entered your valid password during a login attempt.

You note above that:

Signal app is also sending me verification codes at the rate 1/day, although I uninstalled it. This fact suggests me a software issue. I cleaned the cache, but not sure if enough.

This suggests that your OS isn't fully under your control. Whether this is due to malware or just a glitch of some sort, things you've uninstalled aren't going away as they should. I'd suggest backing up any important data (photos, music, text conversations, etc.) and performing a factory reset on your device.

If that fails to clear up the problem, you should take the device to one of your carrier's shops (carrier owned/operated, not franchised -- there's a big difference in the level and type of support available) for further evaluation: your device might have been cloned, a situation that can lead to shocking bills and a lot of headache trying to clear up the charges.

— Zeiss Ikon | Sources

Why many unrequested 6-digit SMS login codes sent to my Nougat Phone?

Other observations in the phone

Topics