In the coming weeks we’re introducing a feature to keep your account safe from hijackers, even if they have your username and password. Now when we detect a suspicious login, users will be prompted to verify their identity by entering their phone number. Users who have not set up their phone number will see a place to do so in the coming weeks. Note that users can skip entering their phone number but may be asked to add their phone number again at a later date. Google will use that phone number to verify their identity upon the next suspicious login. Once a user verifies their identity the alert is dismissed.
This feature only impacts web logins for users who do not have 2-step verification enabled and are not using SSO to login. This feature will be slowly rolling out to Rapid and Scheduled release domains in the coming weeks.
Rapid release and Scheduled release.
For more information: