Google has announced plans to implement QR code authentication for Gmail, replacing the current SMS-based verification system. The change marks a significant shift in Google’s authentication strategy as the company continues its broader push toward making passkeys the default login option for personal accounts and moving away from traditional security methods like passwords and SMS codes.
The transition aims to address several security vulnerabilities associated with SMS-based authentication, which have become increasingly concerning amid a 26 percent surge in mobile phishing attacks observed in 2024. Gmail spokesperson Ross Richendrfer explained that SMS codes present multiple security challenges, including phishing risks and dependencies on carrier security practices. A particular concern is the possibility of fraudsters manipulating carriers to obtain phone numbers through SIM swap attacks, which have led to losses of over $68 million in recent scams.
The new QR code system will be rolled out over the coming months. Instead of receiving a 6-digit code via SMS, users will be presented with a QR code on their screen, which they will need to scan using their phone’s camera app. The method eliminates the need to manually enter security codes, reducing the potential for phishing attacks where users might inadvertently share their codes with malicious actors.
The implementation offers several security advantages, particularly in reducing reliance on carrier security practices. The shift comes as both the FBI and CISA have warned against SMS-based two-factor authentication following multiple security breaches that exposed weaknesses in these systems.
“We’re pleased to introduce an innovative new approach to shrink the surface area for attackers and keep users safer from malicious activity,” said Richendrfer, noting that SMS codes represent an elevated security risk for users.
The change is part of Google’s broader initiative to enhance authentication security, which includes the promotion of passkeys as an alternative to traditional passwords. The company has already made significant strides in this direction, including simplifying its Advanced Protection Program through passkey integration and implementing enhanced biometric security features in Android 15. These efforts are part of a larger industry movement toward FIDO authentication standards, with Google joining Apple and Microsoft in committing to cross-platform FIDO authentication solutions.
Sources: Techlore, Zoho, Google Play, CISA
Follow Us