In the coming weeks we’re introducing a feature to keep your account safe from hijackers, even if they have your username and password. Now when we detect a suspicious login, users will be prompted to verify their identity by entering their phone number. Users who have not set up their phone number will see a place to do so in the coming weeks. Note that users can skip entering their phone number but may be asked to add their phone number again at a later date. Google will use that phone number to verify their identity upon the next suspicious login. Once a user verifies their identity the alert is dismissed.
This feature only impacts web logins for users who do not have 2-step verification enabled and are not using SSO to login. This feature will be slowly rolling out to Rapid and Scheduled release domains in the coming weeks.
Release Track:
Rapid release and Scheduled release.
For more information: