When you log into Tinder you can use your mobile number. Tinder sends you a verification code via SMS. Tinder automatically detects this number and can log you in.

Tinder has only permission to show notification and access location granted. How can Tinder access the SMS verification code? I've never seen such a behavior with another app without proper permission.