“To pull off the attack, the bad guys need to know the target’s email address and mobile number; however, these can be obtained without much effort,”

Users are advised to be suspicious of SMS messages asking about verification codes, especially if they did not request one, and check their authenticity directly with their email provider.

Full details here