How much verification is too much?

from here

This is the precise problem I've been having with GMail. I enter the correct password and then GMail decides that's not good enough. Then they say they needs to verify me so they sends a code to my recovery email, and when I present the code back to them they decide that's not good enough either. Why attempt verification that way if you aren't going to accept the results? Anyway, now they want a cell phone number to send a code to, but I don't have a cell phone and even if I did I have little faith left that the result of that would be any different than the email verification.

Unfortunately I made the mistake of tweeting about the problem and as a result scammers have been sending me messages for days promising to help me get back into my account if I just contact them through Instagram or Whatsapp. I can recognize them for the scams they are, but not everyone would, so essentially Google's attempts to curb account take-overs are actually creating opportunities for account take-overs.