When you log into Tinder you can use your mobile number. Tinder sends you a verification code via SMS. Tinder automatically detects this number and can log you in.
Tinder has only permission to show notification and access location granted. How can Tinder access the SMS verification code? I've never seen such a behavior with another app without proper permission.
Since a few years, Google provides a special system that allows apps to use SMS verification without getting access to other SMS. The approach deliver verification SMS to a certain app is that the SMS has a special format: it ends with a truncated SHA256 hash value of the app package name and the app signature (the first 11 chars of the base64 encoded hash).
An app can retrieve such an SMS if it registers itself for a limited time as receiver for a verification SMS. The Android OS then generates the receiver hash as described and filters incoming messages for the pattern described above. Only those SMS are forwarded to the registered app.
And example SMS is included in this blog post:
Your OTP code is: 123ABC78
FA+9qCX9VSu
The app hash generation method is documented by Google here.
