Did you initiate this attempt?
A hold on your own request belongs to the recovery-delay guide. If you did not make a request, treat the notice as a security signal rather than assuming it is a waiting instruction for you.
Use the account independently
Open Google Account controls from a known address on a device you trust. Review security events and contacts; do not share a code with a sender offering to cancel the request.
Understand why a delay exists
Google explains that recovery holds can give the owner time to notice a request and protect the account. This is not proof of who made the attempt or a guarantee that every notice is authentic.
Preserve relevant context privately
Keep the time and claimed account together with any actual security event. If you are also locked out, use the owner recovery route rather than trying to approve a third-party intervention.