Security Vulnerability: Inability to disable Push Prompts in favor of TOTP/Authenticator

Noob edits:  Following up on my initial post, I’d like to clarify that I am framing this as a security workflow vulnerability rather than a simple feature request.

I believe the current 'forced push' architecture represents a defect in user intent validation. Specifically, by prioritizing a non-deterministic 'one-tap' authorization over manual, high-assurance factors (TOTP/FIDO2), the system creates an unnecessary attack surface for MFA fatigue.

Additionally, there may be a related vulnerability with automated credential management: Password managers that autofill on recognized domains may inadvertently populate TOTP fields during an ATO attempt, effectively neutralizing the 2FA. A truly secure 'Cloud Security Foundation' must allow for a deterministic security posture where the user—not the service—defines the primary gate.

One more important detail…I am confident that my Google password is secure.

I believe that the continuing ATO attempts on my account are simple password reset attempts on my Gmail address.  A bad actor obtains my Gmail address and attempts a password reset.  Google chooses to use push prompts rather than the TOTP method I’ve had in place since 2017, and again, I’m one inadvertent tap away from giving away the keys to the kingdom.  A simple password-reset attempt should not be this dangerous.

I believe the immediate solution is for Google to permit users to select TOTP as their primary MFA/recovery method.  My understanding is that adding a passkey does not help--Google still utilizes push prompt as a recovery option.

Thanks for reading!

I want to add weight to this thread, since it describes exactly what I'm running into, and it's had no response from Google in over seven months.

Right now there's no way to fully disable "Google Prompt" (push-notification MFA) as a second-step method on a Google Account. Any device signed into the account is automatically eligible to receive it, and the only way to stop receiving prompts is to sign that device out of the account entirely — removing Gmail, Photos, and Play Store access along with it. There's no toggle to simply turn this method off the way you can remove a phone number or a passkey from 2-Step Verification.

This matters because simple push approval (without number matching) is the weakest form of app-based MFA according to CISA's own guidance (Implementing Number Matching in MFA Applications, Oct 2022) and is explicitly excluded from NIST SP 800-63B's highest assurance level (AAL3) because it isn't verifier-impersonation-resistant. This isn't a theoretical risk — MFA fatigue/push bombing was the documented entry vector in the Uber (2022) and Cisco (2022) breaches, and in the CISA/FBI joint advisory on Scattered Spider's attacks against MGM Resorts and Caesars (AA23-320A, 2023).

Google previously supported a version of this control — users could choose which specific phones were enrolled for Google Prompt — and removed it on July 7, 2020, switching every signed-in device to automatically-eligible with no public security rationale given.

I already have an authenticator app and backup codes configured as my 2-Step Verification methods. I'm not asking to weaken my account's security — I'm asking to be able to fully turn off Google Prompt as a method, the same way other 2SV methods can be removed, without having to sign any device out of the account. Is this something the Account security team is tracking, or is there a better channel to raise it in?