[verdverm]

Get a physical key and remove other 2FA methods for your email. That would stop them even if you did click yes.

[kozak]

What will happen if I lose the physical key (or someone pretends that they are me who lost the physical key)?

[verdverm]

If you lose the key, keep backup codes somewhere safe.

Most likely if you lose the key, no one will know what it is for or who's it is.

You can also register multiple keys (in GSuite, GitHub, etc.)

[tsjq]

pls pardon my ignorance. does GMail have this physical key feature ?