Google wants users to migrate away from SMS for two-step verification

Google is urging its users to move away from SMS for two-step verification and towards a new prompt feature in order to avoid being compromised by a phishing attack.

The company introduced phone prompts for two-step verification (2-SV) last year, removing the need to enter an SMS code.

The feature runs over an encrypted connection and warns users in real-time about log in attempts to their mobile devices. Users can block these unauthorised attempts.

But it appears some Google customers still prefer SMS codes for two-step verification, prompting the company to try a more aggressive approach to getting users on board the new feature.

It will now start sending out invitations to users to switch to prompts instead of SMS when they sign in.

The prompt verification involves a pop-up on the user's phone asking whether the user was intending to sign in from a particular device and location. Users can select 'yes' or 'no it's not me' on the prompt.

Google will send out the prompt invitations over the next week, and will follow up with those who haven't migrated in six months' time.

The company said it wanted its customers to move away from unsafe SMS two-step verification, a method that is "more susceptible to phishing attempts by attackers".

Attackers have been able to exploit weaknesses in the Signalling System 7 (SS7) network interoperability protocol used by over 800 telcos globally to hijack two-factor SMS texts and break into customers' bank accounts.

"By relying on account authentication instead of SMS, administrators can be sure that their mobile policies will be enforced on the device and authentication is happening through an encrypted connection," the company said.

However, Google said it will allow users to switch back to SMS 2-FV after trialling the prompts if they prefer the text message approach.

Enterprise G Suite customers can enforce security keys for user authentication rather than the Google prompt.

The 2-SV prompt is available for all editions of the G Suite office productivity software. Users on Apple's iOS devices must have the Google Search app installed to use it.