I keep getting unsolicited 6 digit codes from Xfinity. I call and find out that Xfinity has added three mobile lines to my account...

I keep getting unsolicited 6 digit codes from Xfinity. I call and find out that Xfinity has added (unrequested by me) three mobile lines to my account and shipped three Apple iPad devices. When I instruct Xfinity to close the fraudulent lines, the CSR says I have to return the devices first.  I will certainly do that, assuming I get them.  Who should I escalate this to?  How are callers getting the 6 digit codes if I'm not giving them to them?  They're SMS texts (I also have two factor authentication setup on the app and on my gmail, but the codes are coming by SMS text).  Or is Xfinity CS allowing the caller to use other methods of verification that are *not* the 6 digit codes?  CSRs do not answer questions like this - -they just return to their scripts.  Who should I escalate this to?