Gmail users—especially the ones who like to “set it and forget it”—might want to check their security settings this week.
According to a new report from Forbes, Google is making some changes to how it protects your inbox, and ignoring the settings could mean getting locked out of your account.
So, what’s changing?
Gmail is phasing out SMS 2FA
If you’re still relying on text message codes to log into Gmail, it might be time for an upgrade. Google is now encouraging users to stop using SMS-based two-factor authentication (2FA) and switch to something stronger.
The better option? Either set up a passkey—which is basically a password-less login—or use an app-based authenticator like Google Authenticator. These methods are harder to crack and less vulnerable to phishing.
And while text message 2FA isn’t completely gone yet, Google says it’s phasing it out. So the sooner you update your settings, the better.
Beware of fake Google emails
Apparently, some scammers have figured out how to make emails look like they’re coming from real addresses like no-reply@google.com, tricking users into giving up personal information.
Google says these kinds of attacks are rare, but they do happen—and when they do, they’re effective.
That’s why the company is warning users to stay alert. If Google ever contacts you about an account issue, it won’t ask for your password, a code, or ask you to click sketchy links.
In short, don’t trust any “support” message that shows up out of nowhere. If something looks off, ignore it and go straight to your account settings through Gmail or Google’s official help page.
So what should you do?
- Set up a passkey or app-based 2FA
- Review your Gmail security settings
- Never share passwords or codes—especially through email
- Be skeptical of emails pretending to be from Google
How to update security settings
- Go to your Google Account settings, either through the Gmail app or by visiting myaccount.google.com.
- Click on “Security” from the left-hand menu.
- Scroll down to the “How you sign in to Google” section.
- From there, you can:
- Set up a passkey (recommended).
- Switch from SMS-based 2FA to an authenticator app or security key.
Internet culture is chaotic—but we’ll break it down for you in one daily email. Sign up for the Daily Dot’s web_crawlr newsletter here. You’ll get the best (and worst) of the internet straight into your inbox.
