Make sure you disable it in BOTH spots, or you are still vulnerable! Disabling mobile for account recovery still leaves it for 2FA. You need to do both.

https://accounts.google.com/b/0/SmsAuthSettings?LoginInterst...

AND

https://security.google.com/settings/security/contactinfo?pl...