2 weeks ago, I got these SMS messages via the official Bitpanda SMS number (the one that sends you the 2FA normally):

——-

Your sign-in code was successfully reset. If this wasn't you, contact us immediately on +43 1 3950657516

Reference: FPQ92

——

And this one

——-

You signed in from a new device in Beijing (China) through a Ledger Live API. If this is NOT you, call us on +43 1 3950657516

Reference: FPQ92

—-

Looks completely legit and I was really spooked at first. I can see how people fall for this stuff.