Google binning SMS MFA at last and replacing it with QR codes

Google is phasing out SMS one-time passcodes for MFA, citing risks like SS7 interception, SIM swapping, and traffic-pumping fraud, and will shift users toward QR-code-based verification and stronger methods such as security keys. This change aligns with prior guidance from NIST and CISA to avoid SMS for authentication and aims to reduce the attack surface while retaining limited SMS use for identity confirmation.