I just received a mostly usual SMS starting with "Your Google verification code is...". Only mostly, however, because:
- I definitely didn't attempt a new sign in with Google in the last hour.
- I have changed my 2-step auth settings to use an app instead of SMS, though SMS is still a backup option.
- The verification code is very long - instead of 6 characters it's about 50 at the very least, and it contains letters, including caps, numbers and a slash - it essentially looks like it's supposed to be used by an application.
- This number has not been used before to send me verification codes, although it has the same country code and the same number of digits.
I have checked my recent activity (that link would be your recent activity, actually), and I don't find anything remotely suspicious (does this include failed login attempts, by the way, where the verification code was not entered?).
I'm pretty sure my password is secure and has never been revealed to anyone, nor written down, nor reused on another service, nor entered on a device that does not belong to me. But the first two issues with this supposed login attempt might be a good reason to change it, just in case. However, I've never encountered the verification codes that long, so I'm starting to think it's not an actual login attempt and someone might be just someone having fun with SMS.
Please help me decide if there is a possibility my password was compromised.
P.S. I don't think I'm important/rich enough for anyone to be after my account, especially to a degree where they'll go through the trouble of overcoming two-step auth.