Earlier quoted context omitted.
You need the correct password as well. The phone verification takes place after the username/password authentication.
Does it? This line "In addition to protection from fraudsters, StrongWebmail.com protects against friendly-fraud where a boss or spouse snoops on your email. If one of these people tries to log into your account, you’ll receive a phone call alerting you that someone is trying to access your email (like a silent alarm)." Seems to indicate that failed attempts would also text you?
It seems to indicate that, but I don't think that's the intention. When someone tries to log in (and succesfully passes the username/password stage), then you receive a phone call, because only your telephone numbers are registered to the account. It's implicit in the process.