Google Urges Stronger Account Security as Most Smartphone Users Skip Two-Factor Authentication

Google is intensifying its campaign to improve user account security amid a surge in password-related cyberattacks. The company aims to move beyond traditional passwords by promoting the adoption of passkeys, which tie account security directly to a user’s device and eliminate the need for passwords or two-factor authentication (2FA) codes that can be stolen. According to Google’s recent ‘Scams and Protections’ report, conducted with Morning Consult, most U.S. consumers still rely on conventional security practices like unique passwords and 2FA. However, the findings reveal a concerning reality: while 60% of Americans use strong, unique passwords, less than half enable 2FA, regardless of age group. Passkey adoption is higher among Gen-Z (40%) than Baby Boomers (26%), but 2FA usage hovers consistently between 46% and 48% across generations. Worryingly, more than half of U.S. consumers do not use any form of 2FA, relying solely on passwords, which leaves them highly vulnerable to breaches. SMS-based 2FA remains the most popular but is also the least secure, being susceptible to interception and attacks like SIM swapping. Despite evidence that 2FA can prevent over 99% of attacks, its adoption has plateaued below 50%, even as more services make it mandatory. Google recommends passkeys as the most secure option, followed by authenticator apps, and urges users to enable any form of 2FA, even SMS, rather than none at all.