Probably depends on how "trust worthy" you seem to Google for them to trigger this requirement. Things like using Linux, using Firefox, using a VPN, etc.

The irony is that no real scammer would use this setup because they know it would stand out.

Denying scammers the ability to use VPNs and virtual phone farms without standing out does make their job harder

Or it's just being A/B tested right now.

You can reach a point where the phone number you used for 2FA has been "used too many times" and then you're stuck in the middle of registration. There doesn't seem to be any documented limit anywhere and the only solution people have been able to use is find someone else to help you verify with their phone number. What makes this more difficult is when you get logged out of one of your accounts, they ask for a phone number for 2FA to login, you provide the same phone number you used originally (even though it is not officially associated with your account, just to verify registration), but that fails because your number has apparently been used too often. So now you can't even log in to your valid account that already exists. Sure, should have added some other form of 2FA or a passkey to the account, but why can't I verify with the same number I used originally? And just to top things off, you can't use your Google Voice number for 2FA account verification when signing up for another Google service.

>find someone else to help you verify with their phone number

Very risky, either of you gets banned (it's a risk given now ban happy Google are) you'll both lose your accounts.

The number is not associated with your account, it is just used to verify legit account creations. Retroactively nuking an account due to using a "banned" phone for account creation verification would be wild and not in Google's best interests.

You can totally get a random "we've detected a suspicious activity, please verify the phone number you've used during registration" form during login.

IIRC the limit is 4 accounts and it's documented somewhere.

I'm constantly spinning up new accounts for clients and I've used my number on way more than 4 accounts, so maybe it is on a rolling basis over some time period?

I just checked and it asked me to scan QR code and after opening QR code it will attempt to send some random token..

Google is probably doing A/B testing or they are using some sort of ML algorithm....

They should probably go back to the original invite only flow they used when Gmail launched.

Every account having the ability to invite an only small finite number of new accounts is one way to thwart scammers.

That's certainly an interesting idea - mostly everybody should know someone who has a gmail account, so if you get a couple invites a month, that should be plenty and the setup would

Well I was about to say destroy scammers, but I just realized that they would send out spam to places where you could gamble your invites for Real Cash(TM) or just straight up buy them.

This would lower the creation of accounts, but then they would be rarer and worth more to spammers, since a spamming gmail would be rare.

And we would hear sob stories of people getting their accounts closed for inviting spammers.

Not without some kind of delay function and probably filtering/evaluation of which new accounts get this capability...

Everyone here should be familiar with exponential growth of n-ary trees. If you can get one of these accounts and each new invitee gets to invite 2 more, you can already have accounts gone wild.

If it's a tree, it's easier to prune an entire branch that's gone bad.

So, the scammer should send an invite to a real person from one percent of the accounts in the tree, wait a few months, then flip the evil bit on 90-95% of the accounts they registered. If the whole tree is cut off the reputational damage is really high (10,000 valid users nuked because of actions other accounts took...)

Yep, it's a never-ending escalation.

It was not finite, or uniform. I refilled the invites every week or so based on user behavior.

Not really, even "legit" marketing providers have massive automation rigs to warm email addresses, make them behave naturally and email each other in rings for a bit before using them for cold outreach.

So they'd just do this to farm invites if they needed

When you create an account through google services on a phone, you don't even need a phone number.

"A tester in A/B testing situation swears that B tester is not telling the truth"

It certainly disproves a headline saying “Gmail now requires scanning a QR code”.

This is why I always ignore these headlines until I see the change firsthand. In this case it wasn't even an article, only a brief forum comment, for a topic as complex as spam protection. Might not be an A/B test, could just be someone with a low-trust profile (eg Arch Linux ipv6 in Singapore with multiple Gmails).

Well, a headline that states that “Gmail now requires scanning a QR code for some people some of the time” is not too exciting.

I hit both a google QR captcha and traditional captcha today. They're phasing it in.

Yeah I set one up a few weeks ago for testing, same process.

Maybe it depends on the country?