

Because many services only have SMS as 2FA option. Especially government services.
Also it is impossible to use google without enabling the SMS 2FA option. No matter what, with only 2FA authenticator app or email, they will lock down the account by saying “unable to verify”.
















But with a always on VPN they constantly ask to verify our identity, even with passkey or phone number.
Even when I successfully verify my passkey, they will still sent a SMS code to my recovery number. It’s almost impossible to bypass that step and try another method button redirect again to the same phone verification page. If I didn’t give my number, then this message appears, “there is not enough information to prove this is your account. try again later.”
Maybe VPN is a factor that triggering their security system.