Gmail will ditch SMS authentication in favor of QR codes

There are many ways you can authenticate yourself for online services. This includes using authenticator apps and receiving OTPs through SMS. SMS was one of the ways Google’s Gmail used to authenticate users, but that will no longer be the case. Google has confirmed that Gmail will be moving away from SMS authentication in favor of QR codes.

Speaking to Forbes, Gmail spokesperson Ross Richendrfer said, “Just like we want to move past passwords with the use of things like passkeys, we want to move away from sending SMS messages for authentication.” The spokesperson added, “Over the next few months, we will be reimagining how we verify phone numbers. Specifically, instead of entering your number and receiving a 6-digit code, you’ll see a QR code being displayed, which you need to scan with the camera app on your phone.”

So why is Google shifting from SMS to QR codes for Gmail? For starters, the code you receive from SMS can be phished. This means that even though these OTPs are supposed to act as 2FA security, there’s a chance it could be stolen via a phishing attack. Secondly, it also relies on the security practices of your carrier.

Lastly, there is a new scam called traffic pumping. Basically, scammers try to get online service providers to send a large number of SMS messages to numbers they control, ultimately getting paid everytime those messages are delivered. Google has not stated when the QR codes will be implemented, so we’ll have to wait and see.