Google replaces SMS authentication with QR codes to boost Gmail security

(Web Desk): Google is replacing SMS-based authentication with QR code verification for Gmail, marking a major shift in its security strategy.

This change is part of Google’s broader move towards adopting passkeys as the default login method and phasing out older security practices like passwords and SMS codes.

The decision comes as Google works to address security issues with SMS authentication, which has become vulnerable to attacks like mobile phishing. These attacks increased by 26% in 2024, and experts have raised concerns about SMS codes being intercepted or stolen, especially through techniques like SIM swap attacks. These scams have caused millions in losses.

With the new system, users will no longer receive a 6-digit SMS code. Instead, they will see a QR code on their screen, which they’ll scan with their phone's camera app to verify their identity. This change reduces the risk of phishing attacks, as there’s no longer a need to manually enter codes, which could be intercepted.

Gmail spokesperson Ross Richendrfer explained that SMS authentication is risky due to reliance on carrier security, and the new QR code method improves safety by cutting out this dependency. The shift also responds to warnings from the FBI and CISA, who have highlighted weaknesses in SMS-based two-factor authentication.

This update is part of Google’s broader push for better security, including the use of passkeys and biometric features. Google is joining Apple and Microsoft in supporting FIDO authentication standards, aiming to make authentication more secure and easier across platforms. The new QR code system will be rolled out in the coming months, offering a safer alternative to the outdated SMS-based approach.