How do I get Google to stop SMSing me auth numbers?

Question

A couple days ago I logged into a google account from a (presumably secure, non-public wifi) location I don't normally log in from. Google said "hey, check your smartphone" which is something I've seen a thousand times: there's a panel that comes up on your smartphone that says "hey. Is this you trying to log in?"Except this time that panel didn't come up, so I tried again and it let me in. An hour later they send me a text with a G-XXXXXX number.I thought: "Okay. Weird. I guess the system got confused and sent me a text, which is why my smartphone didn't have that 'is it you?' panel."But now I'm getting a text from them every day with an authenticator.I would love to get this to stop, or get enough context to see if this is some sort of attack. But Google rather famously has no customer support.It's similar to this question asked on the google support forums, but Google declined to answer it.https://support.google.com/accounts/thread/117272646/google-keep-sending-me-the-same-verification-code-4-days-how-i-can-stop-it?hl=enAnyone know what's going on with this? Should I be worried I'm under a persistent daily attack from a wiley hacker?Would love to hear if anyone's seen this before or knows how to convince google to only send authenticators when I request them.

not1ofU · Accepted Answer

have you checked connected devices / sign in activity on the account? go to account settings -> secuirty and see if you can disconnect some device / verify sign ins. But it sounds like someone is trying to fatigue you in to acceptingGood luck

politelemon · Answer

Yes sounds like you should be worried.First thing is to double and triple check your security settings.Under myaccount.google.com click on Security. There look at the 'Your devices' section. See if there are any you don't recognize. You can individually select devices and sign those out.Look 'How you sign in to Google', and the 2FA setting under that.Next, rotate your password. It might be that the attacker has your password and is invoking the 2FA via SMS as a 'fallback'. Change your password.

OhMeadhbh · Answer

Ha! I think it may be my google video library trying to get me to re-authenticate my chromecast device. When I get home I'll look a little closer at the UI and see if there are any security related messages.thx to @politelemon and @not1ofU for your suggestions. Crossing my fingers it stops the auth spam and that it really was google sending the messages.

spansoa · Answer

Switch to a hardware-based 2FA method such as a Yubikey (U2F). SMS is woefully insecure and shouldn't be used, ever.

nicbou · Answer

Something like this happened to me but I got more and more verification messages for services I do not use too.
I sideloaded an infected app on my phone (Vanced) and it tries to use my phone as a disposable phone number for 2FA. The number was likely sold on the dark web, so bitcoin scammers, catfishers and a few other bad people tried to use it. I even had WhatsApp messages from horny men in my area who clicked ads on porn sites. They were not very bright.
It all failed because I did not let the app read my SMS. The messages slowly stopped coming.
I only figured out by correlating the start of the messages with the app installation date.