New devices are verified before access. After you enable an authenticator app, country or ISP changes require a TOTP code.