Google sign-in prompt goes to a phone I sold

once you're back in, change the password as well. that signs the account out everywhere, including the sold phone if the buyer never wiped it. quicker than hunting down each device.

On that prompt screen tap "Try another way". It should offer a text code, your recovery email or backup codes if you ever saved any. Once you're in, go to your Google Account > Security, open Your devices and sign the old phone out, then check 2-Step Verification and remove it as a prompt device there too. If the buyer reset it properly it isn't signed in anyway, but the account still remembers it until you remove it.