It’s going to come from Google, not him.

The scammer says “I’m going to send you a code”.

Then they do the forgot password thing. Their victim gets the automated Google text, and the scammer says that’s Google doing the verification. It clearly comes from google, there’s no denying that.

And since scammer initiated it, scammer tells the victim they have to provide it. Because if the person who initiated it gave the code, the process would be pointless.

That’s how people fall for it.

The scammer meant “yes” as in “yes that’s how we’ll verify” where the OP and the person in the screenshot took it as an admission of scam. So they were surprised it kept going.