Why many unrequested 6-digit SMS login codes sent to my Nougat Phone?

Question

I have received the following SMS messages from Google within 24H hours where all but one message (first) is not requested by me. You can note that only the codes sent 23:16 and 23:22 have distinguishing codes. All codes after 00:21 are the same as the first one, indicating that there can be an external process sending those codes, perhaps not even sent by Google or sent by a bug in Google SMS login system process.

• 123456 Google verification code Yesterday 23:16 (requested only by me)
• 654321 Google verification code Yesterday 23:22
• 123456 Google verification code today 00:22
• 123456 Google verification code today 00:52
• 123456 Google verification code today 01:22
• 123456 Google verification code today 13:22
• 123456 Google verification code today 16:54
• 123456 Google verification code [today+1] 01:22
• 123456 Google verification code [today+1] 13:22
• [changed gmail password]
• 234567 Google verification code [today+1] 23:17
• [disconnect my Phonenumber1 from email2, only email1 left there; originally, email1-2 primarily to Phonenumber1, but now, both my email1 for Phonenumber1 and email2 for Phonenumber2 without the interconnection]
• [... monitoring situation now ...]

In relation to the matter, I could not use sufficiently hardened Gmail account (with Fido U2F keys) in my Android phone because of the reason described in the thread answer here. Still, those SMS messages should not be sent at all because my security measure is Google prompt in 2-step verification. So now, I am using a dummy Gmail account which is receiving those verification codes, but which has the same phonenumber connected to it as my main email address so this fact can be a vulnerability somehow.

You note that I keep getting those SMSs, now 3rd day in a row. I really would like find measures to block them coming.

• I have got 01:22 and 13:22 codes many times so indicating periodicity so a likely some software is creating these requests

Oneplus support chat opinion about the case

Thanks for waiting, upon checking that link you sent me, I see that those 6 digit log in codes are Google related issues. - - Thanks for waiting, please follow this link contact them https://gsuite.google.com/support/ - - Try contacting them with this number +1 1800 813 0692

Other observations in the phone

• Signal app is also sending me verification codes at the rate 1/day (at 1648, 2316, 0653 and 1648 in 3 days), although I uninstalled it. This fact suggests me a software issue. I cleaned the cache, but not sure if enough.
• No such problem with WhatsApp.

Phone: Oneplus 3T
OS: Android 7.1.1 Nougat
Security: 2-step verification by Google prompt
Related Google product forum thread: https://productforums.google.com/forum/#!topic/gmail/mtIbMSGclu4;context-place=forum/gmail
Google product forum help ticket: sent today at about 17:00

Answer 1

The most likely source of your multiple two-factor confirmation messages is something making multiple attempts to log into Google or Google+. This might be malfunctioning apps on your device, or someone else (accidentally or intentionally) using your Google ID from another device. You should contact Google, who will be able to confirm the device that was used for the login attempts; if it's your phone, you'll want to look at what app might have a wrong stored password, or that would have been closed and reopening (hence relogging) at those times.

If it's not your phone, you'll want to change your Google password immediately: these two-factor codes aren't generated until after someone has entered your valid password during a login attempt.

You note above that:

Signal app is also sending me verification codes at the rate 1/day, although I uninstalled it. This fact suggests me a software issue. I cleaned the cache, but not sure if enough.

This suggests that your OS isn't fully under your control. Whether this is due to malware or just a glitch of some sort, things you've uninstalled aren't going away as they should. I'd suggest backing up any important data (photos, music, text conversations, etc.) and performing a factory reset on your device.

If that fails to clear up the problem, you should take the device to one of your carrier's shops (carrier owned/operated, not franchised -- there's a big difference in the level and type of support available) for further evaluation: your device might have been cloned, a situation that can lead to shocking bills and a lot of headache trying to clear up the charges.

Answer 2

I wiped down everything in the phone, about 6 hours ago: no new unrequested codes arrived in the phone that time. Wiping cache initially was not enough, and restoring to factory settings initially neither. The problem is an apparent software problem in the OS, since second hand phone and other possible weaknesses because of that. Definitions

• Clean state system/reset to factory settings. Restore system in the recovery state and/or similar i.e. through bootloader and/or similar, not in the state when Android is on etc through Reset in Settings .

Other following changes made to ensure such that such a problem occurrance is minimised in the future.

1. Wipe everything in the system.
2. Bijection maintenance between email addresses and phone numbers: one phonenumber for one email address, only.
3. Android phone primary security phone number is not the same as the phonenumber of the Android phone itself. Security system should be isolated from the core system itself - - primarily, with keys, but in this case, it was not possible due to OnePlus does not support them.
4. ...

Testing root status of the system after wiping everything in the system in the bootloader mode

• Root Checker app gives the status:

  Sorry! Root access is not properly installed on this device. Device: OnePlus A3003. Android Version: 7.1.1.

• Root Check app gives

  ONEPLUS A3003 is not rooted. Running Android 7.1.1 (Nougat)