Google announced in February 2025 that Gmail would stop sending six-digit SMS verification codes, replacing them with a QR code you scan with your phone, alongside passkeys and authenticator apps. The rollout was described as gradual, over months.
The coverage split neatly into two explanations, and both are true — but they are not the same explanation, and the one Google emphasised got the least attention.
The security case, which everyone reported
SMS is a poor second factor and has been for years:
- SIM swapping. An attacker persuades or bribes a mobile operator to move your number to their SIM. Every code then arrives on their phone. The weak point is a human at a shop counter, which no amount of cryptography fixes.
- Interception. SMS crosses the SS7 signalling network, which was designed when the only parties on it were trusted national carriers. It has no meaningful authentication.
- Phishing. A six-digit code is only useful because you can read it out — which means you can be talked into reading it out. A convincing caller claiming to be from support gets the code handed over willingly.
The reason Google actually led with
Google's own framing was "rampant, global SMS abuse". That is not primarily about your account being stolen. It is about a fraud run against Google.
Sending an SMS costs money, paid by the company requesting it. Where an operator shares that revenue with whoever drives the traffic, there is an incentive to manufacture it: create large numbers of fake sign-up attempts that each trigger a verification SMS to numbers the fraudster controls, and collect a cut of the termination fees. The industry calls it artificially inflated traffic, or SMS toll fraud, and it costs the big platforms a great deal every year.
A QR code costs nothing to display. Removing SMS removes the fraud and the bill at the same time.
Both motives point the same way, which is why this is uncomplicated as corporate decisions go: the cheaper option is also the safer one. But notice which argument the company made, because it explains the urgency better than user security does. Platforms have known SMS was weak for a decade without moving this fast.
What replaces it, and the honest ranking
Not all the replacements are equal, and they are often presented as if they were.
- Passkeys are the strongest. The secret never leaves your device and is bound to the site's real domain, so a phishing page cannot use it. This is the only option on the list that defeats phishing outright.
- Authenticator apps generate codes on the device with no network involved, which removes SIM swapping and interception. A code can still be phished.
- The QR code flow removes the SMS network from the loop and is a clear improvement on texting. It is not equivalent to a passkey.
The part that will go wrong
Every move away from SMS has the same failure mode: the recovery path. Lose the phone holding your passkey or authenticator, and you need a way back in — and that way back is usually weaker than the thing it bypasses.
So the practical advice is dull and important. Whatever you switch to, set up a second method and save the backup codes somewhere that is not the phone — printed, or in a password manager you can reach from another device. The accounts people lose permanently are almost never the ones that were hacked.
Sources: Google's announcement; Android Authority; CyberInsider; Gigazine; MakeTechEasier; and Prothom Alo's original report.
