Even easier are the sites that do this: "Please enter the phone number where we should send your one-time 2FA code: [_______]"

I've had that happen on more than one site. Surely anyone who stole my password would just put in their own number?

They would surely compare the number to the one they have registered, right ?

Google oftentimes doesn't.

One of my accounts requires a phone number to verify every single time I login. I have no clue why, and it accepts absolutely any phone number.

I have no clue what the purpose is aside from forcing me to give sensitive information to other people when my phone isn't available or I'm traveling (which I've been forced to do already).

You didn’t set a 2fa in that account. So they ask for a phone number to correlate the login.

You'd think they would make it more clear ("verify your 2fa number"). Maybe they want to bait criminals into entering their own or something.