This is an excellent point. Google seems to be uninterested in addressing this transparently, but despite their push for phishing-resistant MFA and first factor sign-in options, they still consider a phone number to be golden evidence.
My father changed his phone number last year and never updated his Google account. Despite having a recovery email address he could access, TOTP, and printed backup codes, it was not enough. Google wanted to “verify it really was him” after a move (and IP address change) and it doesn’t even allow a password reset to be authenticated with any other recovery option. Phone number or bust.
Given the importance of these digital services I expect that refusing to provide support to users in this situation, as Google is well known to do, won't be legally tolerated at some point in the future. Unfortunately this won't be changing anytime soon, so the best we can do is inform others about the risks of relying solely on Google for anything important and hope people backup what they can.
With Google Workspace an admin can reset / disable your 2FA, so that part is out of your hands anyway.
Finally, I don't see anything in Google Workspace that requires a phone number. Someone can correct me if I'm wrong there.
Discord does the same.
I'm not the only one to have encountered this
That's asking a user to verify themselves with a provided number.
Likely because the user doesn't have anything else set up for 2FA.
What is not true?
> if you've never provided one
I started this thread off with don't provide a number.
Again, set up a alternate 2FA with them and you won't have to deal with a phone number at all.
> and treat that as the provided number for future reference
Even if they did add it in, you could remove it later.
The claim that google will never insist you set up 2FA by providing them a phone number if their ML algorithms decide your log in is suspicious.
Based on my own experiences with a little used google account and finding the messages of other users who have encountered the same error.
What is your basis for claiming that my position is untrue?
1) that's not what I said.
2) that flow you describe isn't asking you to set up SMS 2FA. It is asking you to verify an account with SMS. Likely because there is no other way for them to verify your account.
> Based on my own experiences with a little used google account and finding the messages of other users who have encountered the same error.
The number of people who've reported that error is super small. Even the link you provided is 10 months old. This must be related to an edge case of not having another 2FA set up.
> What is your basis for claiming that my position is untrue?
You said that it insists you add a number. I don't believe that is true. The example you provided does not show that is true.
The forced SMS 2FA that banks and credit card companies have started implementing infuriates me for exactly this reason.
https://news.ycombinator.com/item?id=28251107
I use "SMS Gate", an open source app available on F-Droid:
Also, never lose your phone number. I can't get back into my Google account even though I have the username, password and recovery email because I can never get the SMS code.