The solution is for the official Google (et al) text to include a message about the real reason the code was sent, making it clear that the hacker's first text was malicious.