Got authentication otp from a normal phone number

[ashishsah1000]

Today I signed into my two new devices the first otp that I received was from 503501 and the message was also like **This is your otp 678XXX ** and when next time again I logged into account I got message from a normal message from an Indian mobile number 08295417321 with no message just with an otp. I called that number and a guy picked the call and talk with me as soon as I inquired about otp he disconnected the call.

[queenofcorgis]

Hi there! This is expected behavior, GitHub's 2FA messages can and may be sent from different numbers, including regular ones. But thank you for checking 😄

[ashishsah1000]

Otp is being sent from a normal number. What kind of authentication is this? Could you provide me with some references?

[queenofcorgis]

GitHub uses different services, like Twilio and Vonage, to send SMS messages. In different countries, those companies work with local phone carriers to send our messages, and different carriers have different ways of sending the messages (including different amounts of reliability in delivery, which may involve the sending number being a regular phone number). GitHub does not control any of the details of this, but an OTP code SMS message is likely actually from us if its receipt aligns with when the user signs in, and we will never add links to our messages (a link could be evidence of phishing).

We reported this to the provider and they are doing more research - appreciate you bringing this to our attention.

[startup-dreamer]

Same thing happened to me, and it's weird because I received my OTP from a service provider, as well as from my regular number, which is absurd.

[anurag01a]

@queenofcorgis

Honestly, when I see this, I feel something is phishy, though these codes worked

This was the norm a few years ago.

Please, get this fixed to look official!

[joshuawalker]

This indicates that our messages are being intercepted after they leave our infrastructure. You should report this to your cellular provider and the telecommunications regulatory authority in your region.

[anurag01a]

Thanks for your reply, @joshuawalker.

Can you loop in someone from GitHub India as well, so that we are precise on actionables from my end and on their end as well?

[komalharshita]

i thought github only sent otps through mails