For some time now, Google has been requiring a mobile phone number and verification for creating new Gmail accounts. SMS verification is also used as part of the sign-in process, to verify that a returning customer is indeed who they claim to be.
Google is using an option to enable 2-step verification for accounts without a phone number starting in 2024.
A report from Forbes suggests that this will change in the coming months. Google plans to phase out SMS verification in favor of something else.
The company told Forbes that it wants to move away from using SMS for authentication. Other services, such as X, formerly Twitter, have already abandoned SMS.
Google now uses SMS verification in two cases:
When new accounts are created, to limit mass account creation by malware gangs and malicious groups.
and to verify the identity of a returning user.
While SMS verification is better than no verification at all, the system has significant problems. One of them is that SMS messages are sent unencrypted, which means they can be easily read if intercepted. Phishing is another problem that has increased, and there is always the problem of a user being associated with a specific phone number. Malicious users can gain access to users’ phone numbers through social engineering attacks targeting the user’s Internet service provider.
Google reported an increase in malicious activities related to SMS, and one of them is traffic pumping, which causes online services to send SMS messages to numbers that they charge for.
Google is planning to disable SMS verification for a new system with QR Codes. So instead of asking us to verify access by entering a six-digit code sent by SMS, we will have to scan a QR Code using our mobile phone's camera.
Google believes this system will be beneficial for both itself and its users, primarily because it removes phishing from the equation, considering there will no longer be a number sent to a mobile phone number.
In its conversation with Forbes, the company didn't reveal when it plans to roll out the change, only that it plans to rethink how it verifies phone numbers "in the coming months." So we might see changes in the first half of 2025 at the earliest.
George is still wondering what he is doing here….
