To start with, it could be real, or it could be phishing.
Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. Here are some guidelines:
Identifying legitimate emails from the App Store and iTunes Store - Identify legitimate emails from the App Store or iTunes Store - Apple Support
Recognize and avoid phishing messages, phony support calls, and other scams - Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support
Avoid scams when you use Apple Cash --> Avoid scams when you use Apple Cash - Apple Support
Apple 'How to identify, avoid, and report phishing' video--> https://youtu.be/SR3Z3fXXjfw
If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Try to independently verify the resource by going to a support page on apple.com and use that to contact Apple or to verify with the service the message is telling you to use.
If it is real, two factor is proteting your account as it should. However, there arises the question as to why somebody is able to enter your account password correctly so many times if you keep on changing it.