Important change affects billions of Gmail users

Google is about to remove Gmail authentication method via SMS messages due to security concerns.

Gmail will use QR codes for authentication instead of SMS. Photo: CNET .

Gmail, the world's most popular email service, will officially phase out two-factor authentication (2FA) using SMS codes in the coming months. This is a major change that marks a shift in how Google approaches user account security.

According to an exclusive report from Forbes , the move is not only aimed at enhancing security, but also reflects the trend of technology modernizing data protection measures.

"Similar to how Google has moved away from passwords and toward things like passkeys, we want to move away from sending SMS messages for authentication," said Gmail spokesperson Ross Richendrfer.

Google representatives said that SMS poses many security challenges in the current context. Users do not always have access to the device receiving the SMS code, and it is highly dependent on the carrier.

“If a bad guy can trick a network operator into getting someone’s phone number, the security value of SMS is completely lost,” Ross Richendrfer emphasized the risk.

Over the next few months, Google will change the way phone verification works. Instead of receiving an SMS message and entering a six-digit verification code, users will see a QR code and need to scan it with their phone's camera.

According to Google, using QR code authentication has two big benefits. One is that it reduces the risk of Gmail users being tricked into sharing their secret code with a scammer, since they essentially don’t receive any text. Two is that it eliminates the need for a mobile carrier in most cases.

“SMS codes pose a high risk to users. We are excited to introduce a new, innovative approach that helps narrow the attacker’s reach and protect users from malicious activity,” Richendrfer concluded.

Google’s move not only affects billions of Gmail users, but could also create a wave of change in the tech industry. Other companies are likely to follow suit, hastening the move away from outdated authentication methods.