Right, that's after a failed login for an existing account in steady state, when you get an email "Somebody tried to login, is that you?". Google etc do similar

Right, that's after a failed login for an existing account in steady state, when you get an email "Somebody tried to login, is that you?". Google etc do similar things. I don't know if they have that on the initial signup and email verification though.