[eonmist]

What would have been the lesson to learn in this case? What is a good solution?

I solved it by completely moving away from Google and services where I'm offered little control over verification settings. I remember I found the related settings in Google too restrictive at the time, and they seem to change requirements over time, thus making it too unpredictable for me. The "verify on old phone" really scared me away.

[bitbasher]

Ultimately, the lesson learned was big tech isn't your ally nor is the data you lend to them yours. Act accordingly. If they decide you no longer deserve access to the data, they can and will cut you off.

Personally, I pay for a service (email, data, password manager, etc). I also backup my data in multiple locations. It's a lot of work, but I don't really see an alternative at the moment.