Google says its two-step verification process requires users to confirm a notification after signing in with their password.