Yer that is likely a bad implementation of the automatic confirmation feature. iOS and Android both make it possible to register a receiver for very specific SMS messages with additional permissions.

...or it is just a dump data grab