In my bank (Poland here) they have a mobile app which receives push notifications instead of SMS messages. The notification also contains the reason for the cod

In my bank (Poland here) they have a mobile app which receives push notifications instead of SMS messages. The notification also contains the reason for the code. So in OP's case it would say "Code for resetting your account password", which would probably trigger a red flag sooner.