For years, cybersecurity experts have warned that using SMS-based authentication codes for logging into Gmail is a serious security risk. From SIM swapping attacks to phishing scams and message interception, the vulnerabilities of SMS-based two-factor authentication (2FA) have been well-documented. Ironically, anyone could Google “Why SMS authentication is risky” and find countless articles outlining its flaws. And yet, Google is only now making a major move to address the issue. But as the saying goes—better late than never.

Google’s Shift from SMS to QR Code Authentication

In the coming months, Google will phase out SMS authentication codes in favor of QR codes, a long-overdue update to enhance security. Instead of receiving a six-digit code via text message, users will be required to scan a QR code with their smartphone camera to verify their identity.

This shift comes with multiple advantages:

• Eliminating Code Theft – Since there’s no numerical code to steal, hackers won’t be able to trick users into revealing their authentication details through phishing attacks.
• Preventing SIM Swapping Attacks – Malicious actors will no longer be able to hijack a user’s phone number and intercept SMS authentication codes.
• Reducing Reliance on Mobile Carriers – The security of SMS-based authentication depends on telecom providers, and attackers have found ways to exploit weaknesses in mobile networks.

Google’s decision to eliminate SMS authentication is a crucial step in closing a major loophole that has long put users at risk.

More Than Just Security—Google’s Fight Against Traffic Pumping Fraud

While security is a major reason for this change, there’s another factor at play—Google wants to shut down a widespread scam known as traffic pumping fraud.

Traffic pumping is a scheme where scammers trick service providers into sending large volumes of SMS messages to numbers they control. Every time an authentication message is sent, they earn money from telecom providers, generating fraudulent profits at the expense of companies like Google. By cutting out SMS-based 2FA, Google is closing off this revenue stream for scammers, making the internet a little safer in the process.

A Long-Awaited Move—But Google Is Playing Catch-Up

Google’s transition to QR code authentication is a positive step, but it’s hardly groundbreaking. Several tech giants have already moved beyond SMS-based authentication:

• Microsoft abandoned SMS authentication years ago in favor of its Authenticator app.
• Apple has championed passwordless login methods using passkeys, biometrics, and cryptographic authentication.
• Proton Mail introduced Proton Pass, an integrated 2FA authenticator to enhance account security.

While Google’s shift to QR codes is welcome, the tech giant is playing catch-up rather than leading the charge. Nonetheless, this update aligns with Google’s broader goal of moving toward a passwordless future—an initiative that includes the adoption of passkeys and more advanced authentication methods.

Final Thoughts

Google’s decision to abandon SMS authentication codes is long overdue, but it’s a significant step toward stronger security and fraud prevention. By replacing vulnerable text-message-based authentication with QR codes, users can enjoy better protection from SIM swapping attacks, phishing attempts, and telecom-based fraud schemes.

This change should have happened years ago, but at least Google finally took action—maybe after Googling the risks themselves.