Google To Eliminate SMS Authentication in Gmail, Implement QR Codes

Google is preparing to abandon SMS verification codes for Gmail authentication in favor of QR codes, Gmail spokesperson Ross Richendrfer told Forbes. The move aims to address significant security vulnerabilities inherent in SMS-based verification while combating fraudulent exploitation of Google's messaging infrastructure, he said.

'Just like we want to move past passwords with the use of things like passkeys, we want to move away from sending SMS messages for authentication,' Richendrfer said. The transition will target 'rampant, global SMS abuse' that undermines security and enables criminal schemes. SMS verification currently serves dual purposes at Google: confirming user identity and preventing service abuse. However, these codes are vulnerable to phishing, dependent on carrier security practices, and frequently exploited in 'traffic pumping' scams where fraudsters profit from artificially triggered SMS messages.

The forthcoming implementation will display QR codes that users scan with their phone cameras instead of entering six-digit codes. This approach eliminates shareable verification codes and reduces dependency on telecom carriers. The changes will roll out 'over the next few months,' the company said.

Read more of this story at Slashdot.