Read about how two factor authentication works --> Two-factor authentication for Apple ID - Apple Support
I am at a stage where I never believe any message I see until I can independently verify its authenticity. There's too much phishing going on these days, particularly if it is a text message or email. Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. Here are some guidelines:
Identifying legitimate emails from the iTunes Store - http://support.apple.com/HT201679
Recognize and avoid phishing messages, phony support calls, and other scams - https://support.apple.com/HT204759
Apple 'How to identify, avoid, and report phishing' video--> https://youtu.be/SR3Z3fXXjfw
If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Try to independently verify the resource by going to a support page on apple.com and use that to contact Apple or to use the service the message is telling you to use.
If you think the message is real then it is possible your account information is compromised but 2-factor is working as it should to protect your account. Change your password.
Click on this link "If you think your Apple ID has been compromised" --> https://support.apple.com/HT204145
'Checklist: If you want to see if anyone else has access to your device or accounts' click here --> https://support.apple.com/HT212021
Security and your Apple ID - https://support.apple.com/HT201303
Contact Apple for help with Apple ID account security - https://support.apple.com/HT204169 "This article provides country-specific Apple Support contact information for customers seeking help with their Apple ID password or other security-related issues." Better for directly reporting an issue.