Advertisements have been spotted in text messages with Google's verification code. Reportedly, a phone carrier is responsible.
Text message scam asking for Google account verification codes
According to 9to5Google, Action Launcher developer Chris Lacy tweeted a photo of a real two-factor authentication text message from Google on Monday with a VPN ad and a link at the end of it. Lacy said it asked for a verification code after a failed login attempt, so it wasn’t random text, but Google Messages marked it as spam anyway.
Lacy received a ton of responses to his tweet and it appears a phone carrier inserted the ad into the post, possibly as a clever form of targeted advertising.
According to 9to5Google, Google is investigating the matter and the ad originated from an Australian phone provider.