I use a PayPal account with Two-Factor-Authentication (2FA). Whenever I log in, after entering my password, I receive a code by text message like the following that I have to enter:
PayPal: Your security code is: 123456. Your code expires in 5 minutes. Please don't reply.
The above format and the sender (+1 729725) have been pretty consistent for me for months.
Yesterday night, I received three text identical messages within one minute - while sleeping:
PayPal: Your confirmation code is: 234567. Your code expires in 5 minutes. Please don't reply.
They were sent from the usual sender, and since also the format resembled the previous ones, I feared that someone might have my PayPal password and trying to get past 2FA. Then I noticed that they said "confirmation code", while all other text messages from PayPal say "security code". However, PayPal support has since confirmed that PayPal sent them.
Now I want to find out how the text message was most likely triggered. Does someone really have my password? Or maybe someone just mistyped his phone number somewhere? I have found out that you can trigger sending text messages without knowing the password (this is basically a "forgot password" technique). However, whatever way I try to trigger another text message, I only receive a "security code", never a "confirmation code". You may think that a "confirmation code" sounds less important than a "security code", but I would like to be somewhat certain.
So what is a confirmation code? How can messages with a confirmation code be triggered? And what does receiving confirmation codes without my interaction mean for my account security?