Have you run this by your IT team? They may have a system to send the first number.

Interesting! Please let us know the results when you find out, even if it's benign.

@schroeder I did, but all they could do was reassure me, that there hasn't been any suspicious activity in my account. Also they couldn't imagine, what a scammer would gain by sending me a 2FA, working or not, except he already had control over my computer and would know right away if i requested a code. But even then, why would he send it to me and not just use it himself? They couldn't gather any insights on the first number sadly

Is there possibly a way for somebody to make money off sending these messages without actually hacking me?

Can you reproduce the odd text by using another computer? Can you narrow down the factors that lead to this issue? Does it only happen if you use a certain device, for instance?

If this is a scam, it would have to be someone in between you and Google and trying to get you to give them the 2FA code. Then they get access to your account. But I cannot guess why this odd text only shows up on the first attempt and not subsequent attempts.

This is a clear duplicate of security.stackexchange.com/q/225298/3644 and my answers there and here applies here.

@MartinSchröder It is quite similar, but there is still a difference. The message that Dunois received from the unknown phone number, still contained the original Google message "G-###### ist ihr Google-Bestätigungscode". In my case it didn't come with any message at all. Not sure, if this means something or not, it is a difference though.

@schroeder I just tried reproducing the message on my personal computer (so far i encountered it, when using my work computer), and it happened again, this time coming from a UK number again. This seems to really only occur, when changing 2FA or setting up 2FA for the first time on a new computer or a different browser (1st time was on Google Chrome, work PC, Google workspace account; 2nd time firefox, work PC, private Google account, 3rd time Google Chrome, private PC, private Google Account). The only factor common in all these cases is my phone number or my phone itself

@MartinSchröder I also think that this is not quite a duplicate. It's not just about the number, but the strange message format.

@marlon thanks for the testing. This really is odd. But the fact that it occurs on multiple different machines and browsers and in a limited way means that the common denominator becomes Google. And that means your risk is lowered. It's not you, it's Google. So, I would assess that there is no risk to your account.

@schroeder It did happen on two different Google Accounts though. And if it really is some bizarre type of glitch on Googles side, wouldn't this be a quite severe breach of security, presuming these are random phone numbers that might belong to regular people? (haven't tried calling the newest one yet, but Dunois reached a random person on his number, although that one might have been spoofed of course)

The other question answers this: it's not technically a security issue. Nothing is exposed. It doesn't have to be sent from those numbers, just that what you see is that those numbers are the senders.

@MartinSchröder I actually never tried entering any of the codes, because i am still not 100% sure, that i'm not overlooking some sort of trap or scam behind this. In each case i requested another code, that would always come from the normal "Google"-number. So not sure, if codes from strange numbers actually work or not

Does this answer your question? Is it normal to receive working SMS verification code from strange number?

@MartinSchröder Kind of, but also not really. What i still don't understand is, why a company like Google would outsource their 2FA service to another company, that makes their messages look like a phishing attempt, not even trying to appear like Google would. Also it doesn't fully explain, why I would get a message from a strange number at first, and then get the messages from the "Google"-number after that. If the messages do come from the "lowest bidder for delivery" shouldn't all subsequent messages also come in the same format? Why switch?

@marlon Some companies pay for quality, some don't. And the second try may well have used a more expensive route since then they wanted to ensure delivery. They of course if you have used the code, i.e. if the message reached you.

@MartinSchröder That's an interesting thought, i haven't considered yet. Is there a way to validate this theory, other than googling or calling these numbers? (and apart from requesting another code and seeing if it works, which would also not fully prove it, but be a pretty strong indicator)

Let us continue this discussion in chat.

@schroeder in the above linked thread (security.stackexchange.com/a/175607/246362), you mention that you work for an sms aggregator and that people may scramble the content to avoid being blocked from the telco. Could this go as far as leaving out the message entirely and only sending the code?

@marlon not I, I just edited the post. That's Martin's answer. Too many Schroeders... :)

@schroeder oh, i am sorry. On a funny sidenote... my last name is also Schröder :)

@MartinSchröder the question above was meant for you then, sorry for the mixup