Google QR Code for New Accounts: Bypass in 2026

Starting in late 2025, Google began requiring QR code scans from an existing Android or iOS device for desktop account signups. The shift was confirmed by Google and reported by TechRadar as part of a broader move away from SMS-based authentication. Didn't matter what IP, what browser, what region. No SMS option. No email fallback. Only solution: just a camera pointed at a screen.

For anyone running Google multi-account management workflows at scale, this change broke existing setups. We tested residential mobile proxies, premium VPNs, UK and Japanese exit nodes. None of them got past the QR code wall from a desktop connection. Multilogin's 2026 documentation confirms the same wall affecting their entire user base. If you're coming from the broader guide on creating accounts without a phone number, this is the 2026-specific wall that changed the game.

Here's what most guides still get wrong: this isn't about IP reputation. Google's detection runs deeper, down at the TCP/IP fingerprint level. Understanding why Google requires the QR code for new account signups is the first step toward finding a bypass that actually holds up.

Why Every Proxy and VPN Failed: The p0f Problem

Here's what's actually happening at the network level.

Google uses passive OS fingerprinting, commonly known as p0f, to classify incoming connections before the signup page even fully renders. p0f analyzes TCP SYN packet characteristics: initial TTL values, window size, MSS, TCP options ordering, and the DF bit. Each operating system leaves a distinct signature in these values. Windows 10 looks different from Windows 11, Linux looks different from macOS, and critically, iOS looks different from all of them.

When Google's system detects a desktop OS fingerprint (Windows, Linux, standard macOS), it routes the signup flow to QR code verification. When it detects a mobile OS fingerprint, specifically iOS or Android, it offers SMS verification instead. That's it. That's the whole decision tree at this layer.

The cleanest residential IP on earth won't change this. If the TCP fingerprint says "Windows," it's a QR code. Modern bot detection systems operate at multiple layers simultaneously. FingerprintJS's 2025 analysis documents this multi-layered approach combining server-side TLS fingerprints, client-side JS attributes, and cross-verification. But p0f operates before any of that JavaScript even runs.

The Partial Success That Revealed Everything

Attempt #5 failed, but it revealed the actual bypass mechanism.

We tried a generic mobile proxy provider that offered what they called "iOS fingerprinting." It partially worked. Google's signup page actually showed the SMS verification option instead of the QR code. The first time in our entire testing sequence.

But then a completely different wall appeared. Google sent the verification through an iMessage-style deep link that tried to open Apple's Messages app directly. On a desktop browser, even one spoofing mobile Safari, there's no Messages app to open. The whole flow dead-ended at an "Open in Messages" prompt with no fallback to a standard SMS OTP input field.

So the iOS p0f fingerprint was clearly the key to bypassing the QR code at the network layer. But the browser fingerprint needed to match a device that could plausibly receive SMS through a standard input field, not an app deep link.

That pointed directly to the macOS Safari combination.

The Working Method: iPhone Network + macOS Browser

The combination works because of how Google splits verification logic across layers.

macOS Safari is a desktop browser that shares Apple's ecosystem identity. Google's system sees an iPhone TCP fingerprint at the network layer (mobile device, so SMS verification eligible) combined with a macOS Safari browser fingerprint at the application layer (desktop Safari, so standard SMS input field instead of Messages deep link).

Google's verification logic reads this as someone on an iPhone hotspot browsing from their Mac, one of the most common multi-device scenarios in Apple's ecosystem. No flags raised. This is consistent with how browser fingerprinting works in practice: platforms cross-reference network-layer signals against application-layer signals, and any inconsistency is a detection trigger.

What You'll Need

Before starting, make sure you have:

• A VoidMob account with a dedicated 5G proxy endpoint (not shared/rotating)
• AdsPower antidetect browser (or similar with full fingerprint control)
• A carrier-based phone number for SMS verification (not VoIP)

Exact Setup: AdsPower + VoidMob 5G Proxy

Proxy Configuration:

On VoidMob's dashboard, provision a dedicated 5G mobile proxy with these specifics:

• Carrier: Any major US carrier works (T-Mobile, Verizon, AT&T). We used Verizon (ASN 6167, CELLCO-PART) for our testing
• p0f profile: iPhone 12 (this is the critical setting. Most proxy providers don't expose this)
• DNS: Carrier-native (do NOT override with Google DNS or Cloudflare)
• IP rotation: disabled

Carrier-native DNS is worth keeping. A real iPhone on Verizon uses Verizon's DNS resolvers by default. Overriding with 8.8.8.8 or 1.1.1.1 won't break anything on its own, but it's one more detail that doesn't match the "iPhone tethering on carrier" profile you're trying to present. The goal is fingerprint consistency across every layer, and DNS is part of that stack. See the carrier-native DNS deep dive for a full breakdown of why this matters.

AdsPower Browser Profile:

1
{
2
"os": "macOS",
3
"browser": "Safari 17.4",
4
"screen_resolution": "1440x900",
5
"language": "en-US",
6
"timezone": "America/New_York",
7
"webrtc": "disabled",
8
"canvas_noise": true,
9
"webgl_vendor": "Apple",
10
"webgl_renderer": "Apple M2",
11
"proxy_type": "SOCKS5",
12
"proxy_host": "[your-voidmob-endpoint]",
13
"proxy_port": "[assigned-port]",
14
"dns_override": "none"
15
}

Creation-to-Maintenance Workflow

The actual signup flow is straightforward once the fingerprint stack is right:

1. Launch AdsPower profile with the config above
2. Navigate to accounts.google.com/signup
3. Fill standard registration fields
4. When SMS verification appears (not QR code), use a non-VoIP US carrier number for Google SMS verification. SMS verification provides real carrier numbers from the same dashboard, no separate provider needed
5. Enter the 6-digit OTP
6. Complete account setup, add recovery email (not another Google account)
7. Stay logged in for 15+ minutes, perform 3-4 normal searches
8. For subsequent logins over the next 72 hours, use the same AdsPower profile and same proxy endpoint
9. After the trust-building window, you can move to a shared mobile proxy for cost efficiency (sticky sessions only)

After consistent fingerprinting over a 72-hour window, Google's trust score for the account stabilizes. Subsequent logins become much less sensitive to exact fingerprint matching.

Troubleshooting Common Issues

Still getting QR code prompt: Almost always a p0f mismatch. This was the root cause in the majority of our failed attempts. Use VoidMob's fingerprint test to check canvas, WebGL, and device signals before testing the proxy's TCP fingerprint using a local p0f instance. If the fingerprint reads as Linux or Windows, the proxy provider isn't actually modifying the TCP stack. They're just changing the User-Agent header, which does nothing at this layer.

SMS prompt appears but redirects to Messages app: The browser fingerprint is set to iOS Safari (mobile) instead of macOS Safari (desktop). Change the browser profile OS from iOS to macOS while keeping the proxy's p0f as iPhone. Small difference in configuration, completely different result.

OTP never arrives: Number quality issue. VoIP numbers face 60-80% rejection rates on platforms with fraud detection. Google accepts the number but never sends the code. Carrier-based numbers only. For a full breakdown of how platforms identify VoIP numbers at the signal level, see the guide on avoiding VoIP detection.

Account locked after 24 hours: In our experience, this typically came down to fingerprint inconsistency between the creation session and the first re-login. The same AdsPower profile should be used for the first 72 hours, with the same proxy endpoint. Rotating IPs during the trust-building window is a common mistake when setting up Google multi-account management at scale.

FAQ

Why p0f Is the Key to Google Account Creation in 2026

Google's 2026 QR code requirement isn't going away. If anything, more platforms will adopt similar device-class detection in the coming months. Cloudflare's bot management documentation already describes TCP fingerprinting as a standard signal, and Meta's account creation flow has shown similar patterns in how it classifies device types at the network layer.

We went through multiple proxy types, VPN configurations, and browser fingerprint combinations before landing on this method. The iPhone TCP fingerprint plus macOS Safari browser fingerprint plus clean carrier IP was the only stack that reliably bypassed the QR code wall in our testing.

The detection layer most people don't know exists is p0f. Address it and the QR code wall disappears.