Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me.
Verify it's you
This device isn't recognized. For your security, Google wants to make sure it's really you.
Enter a phone number to get a text message with a verification code.
Obviously, Google thinks that knowing my password is not enough to prove "it's me." I don't have a phone, so I never linked any phone number with my Google account.
What intrigues me is the phrasing. "Enter a phone number" sounds to me like it would accept any number. Obviously, since I never linked a phone number, they do not have anything to compare the number entered into that field to. This also means that they cannot send me a text message with a verification code.
I do not understand how this improves security. They already assume that I may be an attacker who somehow got hold of my password, otherwise they would just let me log in. But what would stop an attacker from entering any phone number in their control so they can receive the verification code? Assuming that an attacker may know my password, how does this prevent them from gaining unauthorized access to my account?