Google plans to stop using insecure SMS verification in Gmail

A username and password just won’t cut it anymore. Users around the world logging into Gmail have often relied on Google SMS pings to securely access their accounts, but that’s changing. Google now hopes to move beyond SMS, which has become so frequently abused that it negates any supposed security benefit. Instead of using SMS, the company will reportedly switch to using QR codes.

Currently, Google sends SMS codes for two reasons: to confirm that a new login is legitimate and to block spammers from opening Gmail accounts in bulk. You type in your credentials, and a moment later, Google texts a six-digit code for you to enter as well. It’s not a terribly arduous process, and it can help protect your account, but SMS is not very secure.

SMS messages are delivered by mobile carriers without encryption, and they often go through intermediaries that can be compromised without your knowledge. Even if the line is secure, phone numbers have very little in the way of security.

SIM swap attacks are depressingly common today, with carrier reps tricked or paid off to transfer a phone number to a fraudster’s device. At that point, the two-factor codes from Google go right to the attacker, allowing them to log in. This same attack has been used to access crypto wallets and make off with valuable digital currency. Gaining control of the target’s email is often a necessary step to unlock other accounts.

According to Forbes, Google plans to patch this vulnerability soon. The company will stop using SMS codes for verification, moving to a QR code that the user has to scan with their phone. 

“Just like we want to move past passwords with the use of things like passkeys, we want to move away from sending SMS messages for authentication,” Google spokesperson Ross Richendrfer told Forbes.

Moving to QR codes takes SMS out of the equation, which also means you don’t have to worry about your carrier’s security practices or lack thereof. Google also points out that QR-code scanning makes phishing scams harder. It’s relatively easy to trick someone into providing an SMS code. Scammers often do this by pretending to be associated with Google, but you can’t share what you don’t have.

Google has not offered much in the way of specifics here. Richendrfer says the change will roll out in “the next few months,” but it’s unclear if all markets will see this change simultaneously. If you already use two-factor on your account, for example with a code generator app or a security key, you’ll continue using that to verify your account. We’ve reached out to Google and will update with anything else we learn about this impending change.

Enhance your driving experience with the P12 Pro 4K Mirror Dash Cam Smart Driving Assistant, featuring Front and Rear Cameras, Voice Control, Night Vision, and Parking Monitoring. With a 4.3/5-star rating from 2,070 reviews and over 1,000 units sold in the past month, it’s a top-rated choice for drivers. The dash cam comes with a 32GB Memory Card included, making it ready to use out of the box. Available now for just $119.99, plus a $20 coupon at checkout. Don’t miss out on this smart driving essential from Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!