Google account registration now requires sending an SMS via phone instead of receiving an SMS

8 min read Original article ↗

I have tried it myself, the registration is no longer possible with the QR code. Supposedly, using the QR code on the smartphone triggers an SMS sent from your phone to Google in order to verify your phone number.

Supposedly, this is for security. A valid argument, since finish is harder this way, although not impossible. However, this prohibits the use of services like SMSpool, too.

Does anyone have any ideas how to handle account registration in the future?

This only stops your average user. Google accounts are sold on a variety of marketplaces and have been for a long time.

The average user isn’t using SMS verification services to begin with. At best, that’s your average privacy-focused individual. Now, how does the average privacy-minded individual best approach creating a new Google account? Buying an account “second-hand” comes with its own risks, because you never know who the account was associated with previously.

5

You just wait, someone will come up with a service that sends a sms to google.

Damn it… Google keeps closing more and more. Hope nerds find a work around soon.

I admire your confidence and hope you are right.

I am curious, is QR code verification currently universal to all countries?

Also, suppose I am on holiday in Italy, which is one of the many countries that requires ID registration to buy or use a SIM. I’m in Italy for only a week and buy a SIM there, which is tied to my ID.

While I’m there I use my Italian number to create an “anonymous” Google account. Upon creating my Google account, I immediately enable 2FA via authentication app and YubiKey, and save my recovery codes. I am able to log into my Google account without SMS verification.

I go back to my country, and keep using my Google account without ever being prompted to verify my number. Because I don’t live in Italy, my Italian number quickly gets reassigned.

I keep using my Google accounts for months and years, without every needing to verify my number.

Can Google trace the account back to my real identity from the Italian number I used?

Do phone network companies or governments keep a record of all the people who have owned the same number?

This is something worth investigating in the country that you live in. I would like to believe that if I owned a phone number for just a couple of months before it was assigned to someone else, Google would not be able to identify me.

I know for a fact that Google does keep a record of all the phone numbers you have used with them. However, they will generally not let you verify your account with a number you don’t own anymore. I know lots of people who forget to update their number with Google when they change it.

8

Sending a SMS that is quite odd given phone spoofing options. I hope they are not stupid enough to use that for MFA.

9

@james1992

Why are you always so negative? I put you on ignore a while ago so don’t waste time answering. It’s more a question you should probably ask yourself.

According to this article from February 2025, Google planned to use it for all SMS authentication, not just registration.

Although it’s hard to tell how difficult it is to spoof the number/text message. Google doesn’t give you a code to send manually.

I don’t like the idea of potentially revealing more details about your device and location when you scan the QR code.

I also wonder what about people with dumb phones? Is it fair to expect them to buy a smartphone?

Just a couple of years ago, I had a boss who I noticed had a dumb phone. He was relatively young, in his 40s, and deliberately used a dumb phone. I never asked him why, but I don’t think it was because he wasn’t smart enough to use smartphone. If some people still use dumb phones it is unfair to expect them to switch.

In relation to this, I also ask myself the following. Suppose you buy a French sim card in France, but then use that same SIM card in Japan. You use that SIM card to register a Google account from Japan.

Will Google be able to detect you’re in Japan (assuming you’re using a VPN) or will they still assume your location is France?

12

I think a security system is at work there, and based on a certain set of metrics, it determines whether or not to send an SMS.
Sometimes a QR code appears for me, and sometimes it doesn’t. Similarly, when a QR code does appear and I scan it on my phone, sometimes I have to send an SMS, and sometimes I don’t.
It all depends on the quality of the proxy and other factors.

Is there a way to opt out? I have seen some people say that for now, it’s not mandatory, and I would like to use this window to create an account.

14

off-topic
image

Leaked image of James using the computer

15

Yeah, looks like Google is slowly moving away from simple receive-only SMS verification.
Matching IP/location/device probably matters a lot more now too.

16

Just wanted to let you guys know I’ve just registered a new Google account successfully with an Android phone with an expired SIM, and Google didn’t ask for phone number or require me to scan a QR code.

Regarding the expired SIM, I bought the SIM and used it for a while and didn’t register my ID so it is now completely locked. I’m not sure if the expired SIM helps, because I didn’t test creating a new account with the same phone but without the SIM card.

17

Impossible to stay anonymous lol. I literally have 15 throwaway accs on my pc. Just use real non-voip number and proper mobile proxy. I even bypass gmail QR code verification. It’s just a matter of a setup, still possible tho. I think I will make a post here on how to do it.

I am trying to understand how you managed to do it. Based on your description, it sounds like you live in a country where ID registration is required to buy or use SIM cards. If so, that makes your case even more curious. I guess every country with mandatory ID registration laws for SIMs has different ways of implementing it.

It seems like where you live there is a trial period. In that a prepaid SIM will work for a short while, but if you don’t register it after a certain point, it will stop working. If that is the case, that is incredibly generous, and I am surprised that your country would pass an ID registration law for SIM and leave such a gaping loophole. I wish I lived in a place where I could exploit that.

I think they just meant it didn’t ask for a phone number or show a QR code flow, while having an expired SIM in the phone. This is still, more or less, standard behavior when creating an account on stock Android, at least.

The QR code flow appears to be triggered if they deem the sign-up high risk. The familiar SMS flow still exists, but it might vary by region. Stock Android is more of a sure thing, as is Chrome with some warm-up.

I haven’t been able to create a Google Account with the usual SMS flow from within the Play Store on GrapheneOS, though.

I never tried that, and I never will.

I had not picked up on the fact that @unseen created their Google account on an Android phone. I have never done that. My attempts to create an anonymous Google account have always been on desktop. Creating one on a phone might increase your chances of success, but your phone will reveal your location to the degree that Google can detect where it was manufactured.

They know if your Samsung phone was made for Korea vs. Canada. This is why I prefer to create my account on desktop, because I want my Google account to contradict the information that my phone will reveal.

If I live in Australia and bought my phone there, I want my Google account to be linked to a different country and a different phone number. Just to make it harder for them to determine my actual ties.

@useen Did you use a VPN when creating your account?

If not, that could also explain why you had an easier time. I always use a VPN.

Ideally, I would create a Google account on desktop (Mullvad) with an American VPN IP and a Swedish phone number for a phone made for Australia.

It’s my understanding that the hardest part is getting a phone number that works. Because if you have a real phone number from Sweden, Google likely won’t care that you are using an American IP and that your phone was bought in Australia. If they recognize the phone number as real and unique, you should be good to go. But getting a real phone number not linked to an ID is hard if you live in a country that requires ID.