Google has unveiled a new QR code-based key verification system for its Google Messages app, specifically designed to enhance security for Rich Communication Services (RCS) messaging. The system enables end-to-end encryption verification through a streamlined approach that improves upon previous verification methods, building on Google’s broader initiative to strengthen messaging security across its platforms.
The new verification feature is being introduced in the latest beta version of Google Messages and will see a broader rollout to Android devices running Android 9 or newer throughout 2025. The development follows Google’s recent announcement to phase out SMS verification for Gmail authentication, reflecting a company-wide shift toward more secure authentication methods.
To use the verification system, users can access a contact’s Details page in Google Messages and select “Verify keys for this contact.” The system then provides options to either display their own QR code or scan their contact’s QR code, confirming matching encryption keys between participants. The implementation follows recent CISA guidelines recommending end-to-end encryption for secure mobile communications.
The QR-based approach replaces the previous method that required users to compare an 80-digit code. “Verify keys ensure only you and your contact can read the RCS messages you send each other,” Google stated. The system provides enhanced protection against message interception and fraudulent activities, particularly addressing vulnerabilities associated with traditional SMS-based multi-factor authentication (MFA). The security upgrade comes amid a surge in sophisticated SMS-based phishing attacks targeting digital wallets and personal information.
The development comes amid growing concerns about SMS-based MFA security, with organizations including the FBI and CISA recommending against its use. Major technology companies have been transitioning toward more secure authentication methods, with industry leaders pushing for passwordless authentication solutions across their platforms.
Google announced in October its intention to develop “a unified system for public key verification across different apps, which you can verify through QR code scanning or number comparison,” the company explained. Google’s roadmap includes plans to expand QR code verification to additional services, including a transition from SMS-based two-factor authentication to QR codes for Gmail authentication. The initiative parallels similar moves by other tech giants, as demonstrated by Apple’s recent commitment to implement end-to-end encryption for RCS messaging on iOS devices.
