Google has announced plans to phase out SMS-based authentication for Gmail accounts in favor of more secure methods like QR code verification and passkeys. The change follows similar moves by other tech giants like Microsoft and Apple to strengthen authentication methods as part of the company’s broader security enhancement initiatives.
“Just like we want to move past passwords with the use of things like passkeys, we want to move away from sending SMS messages for authentication,” said Gmail spokesperson Ross Richendrfer.
The current SMS-based authentication system faces several security challenges. These include vulnerability to phishing attacks, where malicious actors can deceive users into revealing their SMS codes, and SIM swap fraud, where attackers gain control of users’ phone numbers by manipulating mobile carriers. Additional concerns include varying security practices among mobile service providers and exploitation through fraudulent schemes such as “traffic pumping,” where scammers profit from generating large volumes of authentication messages.
Under the new system, users will encounter a QR code on their screen when signing in, rather than receiving a six-digit code via SMS. The QR code must be scanned using either a smartphone camera or a designated authentication application. The change supports recommendations from federal agencies, including the FBI and CISA, which have warned against the vulnerabilities of SMS-based two-factor authentication.
The QR code verification system offers multiple advantages over SMS-based authentication. It reduces the risk of unauthorized access by eliminating transmittable codes that can be intercepted. The system also removes dependence on mobile carriers, thereby reducing SIM swap fraud risks. Furthermore, the QR code scanning process typically provides a more streamlined authentication experience compared to manual code entry.
The transition represents part of a broader industry movement toward more secure authentication methods. The FIDO Alliance reports significant growth in enterprise adoption of passkeys, and major technology companies including Google, Apple, and Microsoft have committed to implementing cross-platform FIDO authentication standards.
Google plans to implement this transition gradually over the coming months, though specific timeline details have not been announced. The change matches the company’s broader strategy to enhance account security through modern authentication methods, including the adoption of passkeys, which have shown promising results in reducing successful phishing attacks and unauthorized access attempts.
Sources: Tech Times, Texas Standard, PhoneArena, Phone World
Follow Us