Google Replaces SMS-Based Two-Factor Authentication with QR Codes for Gmail
Share this post
Google to Replace SMS-Based Two-Factor Authentication with QR Codes for Gmail
Update, October 2026: This article reported plans Google described in February 2025, when a Gmail spokesperson told Forbes that Google wanted to move away from SMS codes for authentication and would roll out QR codes over the following months. The original article is kept below as published. How Google verifies you can differ by account and region, so check the options in your own Google Account (see What you can do today at the end).
Google is taking a significant step to enhance security by replacing SMS-based two-factor authentication (2FA) with QR code verification for Gmail users. This move aims to provide a more secure and efficient way of logging into accounts while addressing the vulnerabilities associated with SMS authentication.
Why Is Google Making This Change?
For years, SMS-based 2FA has been a common method for securing accounts. However, this method has several security risks, including:
-
SIM Swapping Attacks: Hackers can transfer a victim’s phone number to a new SIM card and intercept authentication codes.
-
Phishing Attacks: Cybercriminals trick users into sharing their SMS codes.
-
Message Interception: SMS messages can be intercepted using malware or other techniques.
-
SMS Traffic Pumping Scams: Attackers generate fraudulent SMS messages to specific numbers to earn revenue.
Due to these risks, Google is shifting towards QR code-based authentication, which offers better security and reduces reliance on SMS.
How Will QR Code Authentication Work?
Instead of receiving a six-digit SMS code, users will be prompted to scan a QR code during login. The process is expected to work as follows:
-
When logging into Gmail, users will see a QR code on their screen.
-
They need to scan the QR code using their smartphone's camera.
-
The Google Authenticator app or another trusted verification system will confirm their identity.
-
Once verified, they will gain access to their account.
This method eliminates the risks associated with SMS-based authentication while offering a seamless login experience.
What Does This Mean for Users?
-
Increased Security: Since QR codes cannot be intercepted remotely, this method significantly reduces hacking risks.
-
Better User Experience: Scanning a QR code is quick and eliminates the need to manually enter a code.
-
No Need for SMS Dependence: Users won’t have to rely on mobile networks to receive authentication codes.
When Will This Change Take Effect?
Google has not provided an exact timeline but is expected to roll out the new system in phases over the coming months. Users will receive notifications and guidance on how to transition to QR-based authentication.
Google’s decision to replace SMS-based 2FA with QR code authentication is a crucial step toward improving online security. While SMS authentication has been widely used, its vulnerabilities have made it a target for hackers. By adopting QR codes, Google aims to enhance user security and provide a more reliable authentication method for Gmail users.
Are you ready for the transition?
What You Can Do Today
Whatever Google does with SMS, you can already sign in more safely than with text-message codes. In your Google Account, open Security > 2-Step Verification and look at the options Google offers you:
-
Passkeys: sign in with your phone's or computer's screen lock (fingerprint, face or PIN). Passkeys can't be phished the way codes can.
-
Google prompts: a tap-to-approve message on a phone where you're signed in. Only approve a prompt when you are signing in yourself.
-
Authenticator app: an app such as Google Authenticator generates codes on your phone, without SMS.
-
Security key: a small physical key - the strongest option for high-risk accounts.
-
Backup codes: print or save one-time codes somewhere safe in case you lose your phone.
Never read a verification code out to someone who calls or messages you, even if they say they are from Google or your bank. That is how most code-stealing scams work - see also the call merging scam. If you think someone already got into your PC, our guide on how to remove malware from Windows walks through the clean-up.
Frequently Asked Questions (FAQ)
Is SMS two-factor authentication still better than nothing?
Yes. It is weaker than passkeys, prompts or an authenticator app because codes can be phished or stolen through SIM swaps, but it is much better than a password alone.
What is the safest way to sign in to Gmail?
A passkey or a physical security key. Both resist phishing because there is no code for a scammer to steal.
Will Google ever ask me to read out a verification code?
No. Anyone who calls or messages asking for a code is trying to get into your account.
Where do I change my Google 2-Step Verification method?
In your Google Account, go to Security > 2-Step Verification. You can add passkeys, an authenticator app, a security key and backup codes there.
Comments