Google Is Replacing SMS Codes With QR Codes for Gmail Authentication

Google plans to replace SMS codes with QR codes for account verification.

If you're logging into Gmail, one current authentication option is a six-digit code sent via SMS. However, this method has long posed various security challenges, so the upcoming change is aimed at reducing “the impact of rampant, global SMS abuse,” Google tells Forbes.

That includes scammers who are trying to set up multiple fake Gmail accounts at once.

Google will replace SMS codes with QR codes in the next few months. Instead of entering a phone number and receiving the code via SMS, users will scan a QR using the camera app on their phone to complete account verification. More details are expected soon.

The safety of SMS codes depends on factors such as the user’s access to their phone and the security practices of their carrier. However, fraudsters can trick carriers into gaining access to someone else’s phone number and nullify the security value of SMS codes.

Google has observed SMS codes being exploited in many other criminal operations, including via traffic pumping. “It’s where fraudsters try to get online service providers to originate large numbers of SMS messages to numbers they control, thereby getting paid every time one of these messages is delivered," Google tells Forbes.

Other authentication options include authentication apps, security keys, and passkeys. Google also offers "Sign in With Google," which lets you tap yes or no inside other Google apps as a secondary form of authentication.