Since a few years Google provides a special system that allows apps to use SMS verification without getting access to other SMS. The gerenal approach is that  the verification SMS starts with a `<#>` and ends with a truncated SHA256 hash value of the app package name and the app signature (the first 11 hex chars).

An app can retrieve such an SMS if it registers itself for a limited time as receiver for a verification SMS. The Android OS then generates the receiver hash as described and filters incoming messages for the pattern described above. Only those SMS are forwarded to the registered app.

And example SMS is included in [this blog post][1]: 

    <#> Your OTP code is: 123ABC78
    FA+9qCX9VSu

The app hash generation method is documented by Google [here][2].


  [1]: https://medium.com/@ctrlshifti/android-sms-retriever-api-computing-the-app-hash-for-sms-otp-auto-read-and-verification-cd2a39a2dcd8
  [2]: https://developers.google.com/identity/sms-retriever/verify