Since a few years Google provides a special system that allows apps to use SMS verification without getting access to other SMS. The gerenal approach is that the verification SMS starts with a <#> and ends with a truncated SHA256 hash value of the app package name and the app signature (the first 11 hex chars).
An app can retrieve such an SMS if it registers itself for a limited time as receiver for a verification SMS. The Android OS then generates the receiver hash as described and filters incoming messages for the pattern described above. Only those SMS are forwarded to the registered app.
And example SMS is included in this blog post:
<#> Your OTP code is: 123ABC78
FA+9qCX9VSu
The app hash generation method is documented by Google here.