SMS shows up in alert box. Why?
Is this 2-step auth system making use of that?


Could be, in order to be sure, we need details on the application. Open the config tool, check the application that is creating the confirmation box, and check if that app has access to read your SMS.


  Perhaps setting a flag in the header or something?


There are no "headers" in the sms PDU. They can either filter by "sending number" (the number from the SMS sender), or by filtering words inside the message. Check if the received message always starts with something such as "X company says..."


  What is going on?


Again, this is speculation, since we saw no details on your problem. But...

It is possible to intercept SMS messages, read then, check for a condition, then use an ordered broadcast to open an application, and given a specific condition, become the default sms app, stop the continuation of sms delivery intents, and erase the message, then stop being the default app, or just let it fly onwards...