• Google is reportedly moving away from using SMS as a multi-factor authentication method.
• Instead the company says it will introduce QR codes that users can scan to login.
• Google says that SMS is too easily compromised and as such is urging users to explore other MFA methods it offers.

Many big tech firms are moving away from SMS-based multi-factor authentication (MFA) owing to the fact that it can be easily compromised. To that end, Google appears to be the next company to be abandoning text message authentication.

For now, it appears that Google wants to ditch SMS authentication for Gmail access. This is according to Google insiders who spoke with Davey Winder, a senior contributor at Forbes.

A spokesperson told the contributor that Google wants to replace text messages with QR codes as a method of authentication which is, to our mind a good idea and will add to Google’s existing MFA options for Gmail.

SMS is not the safest method of authentication as carriers can be easily compromised by an attacker pretending to be a user. With enough basic information and social engineering, an attacker can have a number ported to another SIM card before the victim even knows what is happening. With the victims number, the attacker can receive SMS codes and gain access to an account. This is why many financial institutions and online platforms have begun migrating away from SMS authentication.

“Over the next few months, we will be reimagining how we verify phone numbers,” Google’s spokesperson told Forbes. “Specifically, instead of entering your number and receiving a 6-digit code, you’ll see a QR code being displayed, which you need to scan with the camera app on your phone.”

Google already has two MFA methods in place that users can use. The first is rather basic in that you still need to enter your password but then need to open your Google or Gmail app to authorise the login attempt. The second method is one that is increasingly gaining popularity among a multitude of online platforms, a passkey.

A passkey requires that you have your smartphone on you to verify the login. It’s very convenient and unless an attacker has your device, it’s much harder to crack. We’ve been using passkeys with Windows for a few years and it has made logging into our Microsoft accounts painless.

There is another method that comes highly recommended and that is using an authenticator. These are great tools for those who may not always be online as the authenticator generates a token that can be keyed into the platform to authenticate the user.

You can head here to find out about Google’s MFA options. We recommend setting up multi MFA options just in case you lose your smartphone or you can’t get prompts from Google. The solutions work on multiple platforms.

In fact, we recommend taking some time this week to set up MFA for your online profiles and the platforms you use. This is a good way to guard against attackers and insure you’re just that little bit safer online.