With iCloud, that works by only letting you log in if you have access to another phone that has already logged in – when that happens, your phone or other device will show a code that can be entered to verify that you're really trying to log in, along with the details of the person attempting to do so.