Gmail registration now requires scanning a QR code and sending a text message

Original Article ↗ Hacker News Discussion ↗

New Gmail Registration Flow

  • Reports that some new Gmail signups now require scanning a QR code that opens a prefilled SMS to Google; user must manually send it.
  • Others still see the old “enter phone number, receive SMS code” flow, or can create accounts without SMS (e.g., via Android/ChromeOS), suggesting A/B testing, risk-based triggers, or regional differences.
  • Some users hit a limit (“this phone number has been used too many times” / “not eligible”) with no clear recourse.
  • It’s unclear whether this SMS-from-user flow is universal or only for “low‑trust” scenarios (VPNs, unusual IPs, Linux/Firefox, etc. are speculated).

Motivations and Security Concerns

  • Many think this is to fight spam, phone farms, and SMS‑pumping fraud, by shifting SMS cost and friction to the user.
  • Others argue relying on SMS is dangerous in 2026 due to SIM‑swapping and roaming issues.
  • Several note Google accounts are used as a low‑fraud signal across the web, increasing pressure to harden signups.
  • Some see it as another step toward stronger identity binding and potential future government‑ID linkage.

User Experience and Lockouts

  • Multiple anecdotes of being locked out despite correct credentials because 2FA was silently enabled or old phone numbers were required.
  • Users complain about lack of human support and opaque limits, especially for Workspace and business‑critical accounts.
  • Elderly and non‑smartphone users (flip phones, broken cameras) may be excluded by QR‑centric flows.

Spam, Scams, and AI

  • Many report worsening spam and phishing, including scams leveraging Google services (storage, AppSheet, DocuSign‑like services).
  • Others say their Gmail spam filtering is excellent, suggesting uneven performance or experiments.
  • AI is blamed for enabling more scalable, personalized scams, while also being marketed as a defense.

Alternatives and Exit Strategies

  • Strong sentiment toward moving away from Gmail and Google Workspace to paid or privacy‑oriented email (Proton, Tuta, Fastmail, Zoho, Runbox, self‑hosting, Apple’s iCloud mail, etc.).
  • Owning your own domain is repeatedly recommended to avoid vendor lock‑in, though many note most people won’t pay or manage this.

Monopoly, Regulation, and “Free” Email

  • Heated debate over whether Gmail is a “public infrastructure” burden or a highly profitable data‑harvesting monopoly.
  • Some call for antitrust action, service unbundling, real liability for outages/lockouts, and ending de‑facto email duopoly behavior.