PaterAlf: Right at the moment I only get a warning after the password was changed (no matter if I use 2FA or not). That's pretty useless in my eyes.
almabrds: I get a new email every time I access my account in a different computer. I'm forced to insert a random code, otherwise I can't access my stuff.
Wouldn't I receive an email if someone else tried accessing my account, too?
It most likely would, the system doesn't know who is trying to login (unless Skynet is real xP), it would assume it's me, and would send me the code, by email.
I would change my password
s immediately after receiving this suspicious email. Pretty useful, in my book.
Sorry to chime in, as it looks like the "argument" is over, but I have the impression that you guys have been discussing 2 different scenarios from the beginning, and therefore some misunderstanding has ensued.
You were talking about login 2FA, and getting notified of people trying to access your account. That's very useful, but it happens way before the scenario that
PaterAlf was pointing out.
He was talking about how useless it is to get an email *after* somebody has accessed your account (because for whatever reason you don't use login 2FA) and has changed your email or password. In every other site I know of, you get an email *before* those operations, asking you to confirm them. That's a very standard form of 2FA, and it's really surprising that GOG does it the other way round. Here, if somebody guesses/obtains your password and you're not using login 2FA, you can kiss access to your account goodbye. In other sites, you can still access your account and kick the hacker out of it, because you still control the password and associated email.
My apologies if that was actually clear. I just got the feeling that your conversation ended somewhat abruptly because you were not talking about the same thing.