Starting from Android 6 there is an Api from Google which can Listen for a Incoming SMS for you. But you do not need any Permission for this. The SMS ends up in the Devices standard SMS App but your app can do an Phoneauthentification using an SMS from your Server. Usually the way would be: 1...
www.b4x.com