What’s New
Google is experimenting with a new security feature that uses QR codes to verify text messages in Google Messages. The idea is to protect users from spoofed SMS, phishing attempts, and compromised one-time passwords (OTPs). While still in early testing, QR verification could reshape how Android users interact with both SMS and RCS conversations.
How QR Code Verification Works
Instead of relying only on numeric codes delivered by SMS, users would scan a QR code shown by a trusted source, such as a brand’s app or website. This scan can:
-
Link a conversation to a verified sender profile in Google Messages
-
Authenticate a user without sending OTPs through SMS
-
Confirm that a device and thread belong to the same user and business
In practice, this creates a secure “visual handshake” that helps reduce fraud.
Why Google Is Testing QR Codes
Smishing—phishing via text messages—remains a serious problem. Attackers can easily spoof sender IDs or trick people into revealing OTPs. QR code verification helps by:
-
Adding out-of-band confirmation
-
Reducing reliance on easily phished SMS OTPs
-
Binding a conversation to a verified brand identity
-
Offering an extra layer of trust beyond spam filters
Benefits for Users and Businesses
For users: Stronger protection against fake texts, faster logins, and clearer identity signals in conversations.
For businesses: Lower fraud rates, more trusted engagement, and easier compliance with messaging standards.
For carriers: Reduced abuse of SMS channels and stronger safeguards against spoofing.
Challenges and Limitations
-
Accessibility concerns for users with visual impairments
-
Risk of malicious QR codes if not verified properly
-
Inconsistent rollout across devices, carriers, and regions
-
Businesses needing to adopt RCS Business Messaging programs to participate
How It Fits with RCS and SMS
RCS already includes features like verified business profiles, branding, and high-resolution media. QR code verification would strengthen this ecosystem by confirming that conversations are linked to legitimate brands. It could also serve as a bridge for businesses moving away from SMS OTPs toward more secure options like passkeys.
Comparison with Other Authentication Methods
-
SMS OTP: Convenient but vulnerable to phishing and SIM swaps
-
Authenticator apps: Secure, but require extra setup
-
Passkeys: Strongest solution, but adoption is still growing
-
QR verification: A middle ground—simple, widely understood, and safer than SMS OTP
What Users Should Do
-
Scan QR codes only from trusted sources, such as official apps or websites
-
Look for verified sender badges in Google Messages
-
Avoid third-party QR scanners when possible
-
Keep devices updated for the latest security protections
What Businesses Should Do
-
Audit current SMS OTP flows and reduce reliance on them
-
Explore RCS Business Messaging with verified branding
-
Plan QR verification as an alternative login method
-
Educate users about safe scanning practices
Timeline and Availability
Google has not confirmed a global rollout. The feature appears in limited beta testing inside Google Messages, with availability likely to expand gradually. Businesses and users should treat it as experimental for now.
Conclusion
QR code verification in Google Messages is still in testing, but it reflects Google’s push to make text-based communication safer. By reducing reliance on SMS OTPs and spoofed sender IDs, this feature could help make everyday texting more secure for billions of Android users.
