Mr. Talcove said the only way Americans can protect themselves is to not scan QR codes unless they are certain a code is legitimate or use a second phone without sensitive information stored on it.

Gmail and other Google services will shift from texting six-digit codes over SMS to sending a QR code that a user can verify. "Just like we want to move past passwords with the use of things ...