Google plans to stop sending six-digit authentication codes via SMS as a two-factor authentication tool for Gmail, Forbes reports. Instead, over the next few months, QR codes will be introduced to replace SMS codes to “reduce the impact of rampant global SMS abuse,” Gmail spokesperson Ross Richendrfer told Forbes.
According to Richhendrfer, Google uses SMS codes both to verify that it is dealing with the same person who created or owns the Gmail account and as a deterrent to prevent malicious actors from creating “thousands of Gmail accounts to spread spam and malware.”
But while SMS codes are better than not using two-factor authentication at all, this approach has its security risks. Criminals can trick or coerce users into sharing a code sent via SMS, and users may not have immediate access to the device that receives the codes. It also depends on each operator’s own security practices, as well as how diligent their customer support teams are in preventing fraudsters from accessing other people’s mobile numbers.
