- Google will soon phase out SMS-based two-factor authentication in favor of QR codes.
- The company will use various techniques, including attempting to verify the user’s number directly with their carrier using the user’s mobile device. In some cases, users will have to send an SMS to Google instead of Google sending an SMS code to them.
- Users will have fallback authentication mechanisms available, but they’ll still need a phone.
RCS has replaced SMS for most communication needs, but SMS continues to remain useful for some use cases, like two-factor authentication. Not for long, though, as companies like Google have already announced plans to phase it out in favor of QR codes. We now have more details from Google on its impending swap from SMS to QR codes.
Google spokesperson Ross Richendrfer reiterated that SMS is mainly used as a security and anti-abuse check, but there are plenty of security challenges, like phishing and traffic pumping. Consequently, Google plans to reimagine how it verifies phone numbers over the next few months. Instead of entering their phone numbers and receiving a six-digit code over SMS, users will see a QR code they need to scan with their phone camera.