This sounds like they were using the "tap a button on your device" 2FA method (see https://support.google.com/accounts/answer/7026266 https://support.google.com

This sounds like they were using the "tap a button on your device" 2FA method (see https://support.google.com/accounts/answer/7026266 https://support.google.com/accounts/answer/7026266). Not sure of the details as to how they got to that page in the first place, though the docs say that you can potentially use it to recover your account. Never trust an incoming call, especially if it's talking about authentication problems you didn't know you had. Googler, opinions my own (and I'm not an expert in this particular space).