This topic

New login screen bypassing 2FA

AliG3 — Thu, 21 Mar 2024 14:56:24 GMT

I have 2FA enabled - with the login requiring a code that is texted to me. The new BT login screen bypasses the 2FA and logs me straight in from user/pass with no 2FA challenge. I have changed no settings my end. Why have BT made the protection on my account weaker?

(Logging on using webmail, firefox, macbook pro)

Re: New login screen bypassing 2FA

gg30340 — Thu, 21 Mar 2024 15:29:15 GMT

If you have already been using your device and browser with 2FA you may have already saved it as a "Trusted device" and you would not normally require to log on using a code. You can check your Trusted Devices by following the instructions in the following link.

2FA would only normally kick in if you are using a new device that has not been marked as a "Trusted Device" or obviously if somebody else ie a hacker, is trying to log on using an unknown device.

Two-step authentication | BT Help

Re: New login screen bypassing 2FA

AliG3 — Thu, 21 Mar 2024 16:05:47 GMT

Hi - thanks for the rapid reply. I can confirm I haven't trusted either the device or the browser. Using the old login screen - the 2FA challenge presents itself (I just checked) - using the new login screen no 2FA. Have also just checked my 2FA settings and they are still enabled.

Would add screen grabs with todays's date showing the 2fA does still work off the old login screen but can't see how to add images?

Re: New login screen bypassing 2FA

gg30340 — Thu, 21 Mar 2024 16:11:07 GMT

Log out of your email then try clearing your browser's history and cookies and restart your device and try logging on to see if that activates 2FA.

To add an Image click on the Camera icon in the menu bar above the reply text box but there is no need to add an image unless it is telling us something that you are not.

Re: New login screen bypassing 2FA

gg30340 — Thu, 21 Mar 2024 16:13:54 GMT

Just a thought, are you a BT Broadband customer or paying for your email through a BT Premium email account?

Re: New login screen bypassing 2FA

AliG3 — Thu, 21 Mar 2024 16:14:52 GMT

Will try that and report back.. cheers

Re: New login screen bypassing 2FA

AliG3 — Thu, 21 Mar 2024 16:26:53 GMT

BT Premium Mail (ex broadband customer) but have only ever used 2FA under Premium email.

Cleared cache and history - restarted. Same issue. There's clearly something not working on the new login page signin that bypasses the 2FA.

Re: New login screen bypassing 2FA

gg30340 — Thu, 21 Mar 2024 16:33:06 GMT

The reason I asked what type of email account you have is that 2FA is only available to BT Broadband customers that have are using Standard email and BT Premium email account holders. It is not available to BTMail Basic account holders.

Given that you have checked your MyBT and 2FA is showing as active and you have not marked your device as a Trusted Device there would appear to be something wrong with the "new" login page or with your account while using that page.

There will be nothing that forum user will be able to do to help so I have notified the moderators of the forum about your problem. Once they have read this they may be able to help or at least pass this on to the relevant department. They will advise you by posting on this thread.

Re: New login screen bypassing 2FA

AliG3 — Thu, 21 Mar 2024 16:41:45 GMT

Cool - appreciate you taking the time. Thank you.

For completeness on this thread I checked using Chrome - with the same outcome. On firefox I was using a private window - on chrome not incognito.

Re: New login screen bypassing 2FA

DavidM — Thu, 21 Mar 2024 16:53:24 GMT

Hi @AliG3 and thanks for posting.

This sounds like a mystery so we'll need to get our email guys to check what's happening. I can get the details over to them. Check your inbox for my message and drop me a reply.

Cheers

David

Re: New login screen bypassing 2FA

DanielS — Mon, 25 Mar 2024 18:13:02 GMT

Hi @AliG3,

I wanted to give you an update on this. Our new authentication platform is risk based and uses several factors to decide when to make a 2FA prompt. For security reasons we cannot reveal the risk based factors that are used, but please be assured that if the platform detects the required level of risk then a 2FA prompt will be made.

Thank you
DanielS

Re: New login screen bypassing 2FA

AliG3 — Wed, 03 Apr 2024 18:15:51 GMT

Hi Daniel - really sorry I missed this reply. Good news that 2FA hasn't been lost - and the user journey has been made more frictionless.

Cheers for the update.

Allen

Re: New login screen bypassing 2FA

Kielty23 — Thu, 02 May 2024 15:13:27 GMT

just as an aside to this - I have 2fa activated but when I go in to try to amend/look at authorised devices under >your details>edit 2 step authentication settings - the option crashes saying..

Sorry, we couldn’t save your changes. Please try again.

Is it broken at the moment?

Re: New login screen bypassing 2FA

gg30340 — Thu, 02 May 2024 15:25:57 GMT

@Kielty23

See this thread and in particular message 3 about problems with 2FA

Two-Factor Authentication Settings keep disappeari... - BT Community

Re: New login screen bypassing 2FA

Kielty23 — Thu, 02 May 2024 15:29:23 GMT

brilliant👍 thank you..

Re: New login screen bypassing 2FA

harveysprimrose2012 — Fri, 16 Aug 2024 13:50:52 GMT

I'm fascinated to understand what "risk based" is.

I've tried everything to get 2FA working on MY BT.

Different search engines, different devices (Inc my daughters laptop which I've never used to sign onto MY BT. So I assumed maybe it's done on GEO Location. I asked a friend of mine who lives in the west country (I live in the South East of UK) to sign onto my MY BT. He lives 100 miles away from me.

He was able to sign on to my MY BT Account without being challenged by 2FA.

Please explain that? Had he been a scammer/hacker tried he/she would not be challenged.

What risk based system allows this to happen?

Re: New login screen bypassing 2FA

harveysprimrose2012 — Fri, 16 Aug 2024 14:14:27 GMT

Also - why does 2FA not apply when changing passwords?

Re: New login screen bypassing 2FA

harveysprimrose2012 — Wed, 21 Aug 2024 12:51:11 GMT

@DanielS I'm keen for your view on my experiment to find a way for BT's 2FA to actually prompt when logging on or even when changing the account password (MY BT).

It's been puzzling me as to what are in the BT Risk Based Factors which stop a prompt from the new 2FA system.

I've tried different browsers, different computers at my home address. Thinking it must pick up GEO location or IP address of the BT router I got a friend to try, he lives 100 miles away. All experiments worked without being prompted for 2FA. So I got another friend to sign onto our MY BT account via his mobile, using 5G and with Wifi disconnected. He too was successful without being prompted for 2FA verification.

Is BT's new 2FA system so special it forgets to actually prompt your customers?

I'd love to hear from any of the 25 million BT consumer customers who have found a way round BT's new risk based 2FA and got it to work.

Feeling quite vulnerable given the security questions used by BT are consider weak and unsophisticated.

Re: New login screen bypassing 2FA

TerraNova — Fri, 14 Nov 2025 21:05:41 GMT

Appreciate this is an older thread but just for info. I recently activated 2FA on my account and to date I have never been asked to authenticate when I log in.

Clearly BT 2FA is still not doing what it promises and needs to be investigated.