Gmail users will soon be saying goodbye to SMS verification. (Image: Getty)
Millions of people the world over use Gmail, Google’s email service, and for good reason. It’s free and easy to use, works with iPhone, Android, Mac and Windows, and syncs instantly across all of your devices. It also has several security features when logging on or to confirm your identity, one of which uses text messages sent to your number.
This is called SMS verification, and is used by any apps and services. If, for example, you need to log in on a new device or the servers detect a suspicious log in, even if it’s you, might send you an SMS with a code to type into the device you’re usin to verify your identity.
This is designed to stop fraud or identity theft. Bad actors might be trying to access your Gmail inbox for nefarious purposes, but the idea with SMS verification is they will not also have access to your mobile phone, so will not receive the code, and therefore will not be able to log in to your account.
But according to , that is set to change. Google has decided to ditch SMS verification in favour of a new system, with the firm claiming criminals are getting too good at bypassing the text message process.
“If a fraudster can easily trick a carrier into getting hold of someone’s phone number,” Gmail spokesperson Ross Richendrfer told Forbes, then the “security value of SMS goes away.”
Richendrfer and his Google colleague Kimberly Samra said SMS codes can be phished much more easily and bad actors can end up porting your number to their own devices, opening up the abuse of SMS verification. They also said people don’t always have immediate access to the device the codes are sent to, and the whole text system’s security relies on the security practices of mobile operators worldwide. Their security measures can differ significantly in effectiveness.
“Over the next few months, we will be reimagining how we verify phone numbers,” Richendrfer said. “Specifically, instead of entering your number and receiving a 6-digit code, you’ll see a QR code being displayed, which you need to scan with the camera app on your phone.
“SMS codes are a source of heightened risk for users … we’re pleased to introduce an innovative new approach to shrink the surface area for attackers and keep users safer from malicious activity.”
The Google spokespeople did not confirm when this change will be taking place, but it’s good to know it is coming so you aren’t alarmed when you stop getting those six-digit text messages from Google.
Google is moving to change verification and security measures in other areas, including the recent move to introduce passkeys to its app logins and verification. This is the process that replaces the need for you to type in your username and password into apps and services, instead verifying your identity with your device’s passcode or your registered fingerprint or face data, depending on your device. Google views this as a safer alternative to passwords, which like phone numbers, could be hacked.
Of course, you’ll need to have a smartphone or tablet in order to scan the QR codes that appear on your other devices in order to use Google’s new system. It’s not clear how Gmail users without a smart device will be able to scan them, for example, if you have a dumbphone and a laptop.