This topic

Compromised Account SMS Text Messages

swusr2025 — Sat, 16 Aug 2025 14:41:30 GMT

Hi there,

Every day I receive an SMS text message advising me that my Email account has been compromised. After receiving the message, I am no longer able to access my email account until I have reset the password. This prevent me from using the Windows Mail application until I reset the password via the web user interface.

I have 2FA enabled for the account.

If anyone has any idea why this is happening it would be of great help.

Thanks.

Re: Compromised Account SMS Text Messages

licquorice — Sat, 16 Aug 2025 15:26:16 GMT

Are you using a VPN?

Re: Compromised Account SMS Text Messages

sizzleme — Sat, 16 Aug 2025 17:32:36 GMT

Thanks for the reply.

No we are not using a VPN, but the email is being accessed from in the web UI and mail client in Jersey, Channel Islands. From what I can tell, it doesn't seem to be happening as a direct result of checking for or retrieving email in the Windows Mail app.

It can work happily for many hours (usually around one day) then the message arrives and the account password needs to be reset.

Re: Compromised Account SMS Text Messages

gg30340 — Sat, 16 Aug 2025 18:09:59 GMT

Do not post it but is your email address something that could easily be similar to another person's with a change or omission of a digit because it could be that some is just trying to log onto their own email address but have made a mistake when entering it.

Have you checked that you are entering the correct email password given that you have had to change it so many times?

Did you ensure that all your devices you use had the password changed to the "new" one?

Have you checked that if you use a web browser to log on that if you use the browser's save passwords function that it is using the "new" password?

Have you checked on Windows Mail that the new password is correct for both incoming and outgoing servers?

Re: Compromised Account SMS Text Messages

sizzleme — Sat, 16 Aug 2025 22:00:48 GMT

Thank you for your reply...

I am assisting the original poster with this, but will try to answer with the information I have thus far..

Email address is a name followed by three digits. Anything is possible, but I don't think another user is using a similar account and attempting to login every day with wrong details.

Have you checked that you are entering the correct email password given that you have had to change it so many times?

Yes. The details are entered using a password manager and are not entered at all until the SMS message is received.

Did you ensure that all your devices you use had the password changed to the "new" one?

As far as I know, there is only one device (a Windows PC) that is used. Will double check.

Have you checked that if you use a web browser to log on that if you use the browser's save passwords function that it is using the "new" password?

Yes. Using a password manger - with the new details. The web browser is only used after a SMS notification is received instructing that a password reset is necessary. Web browser is not used at all until the notification is received.

Have you checked on Windows Mail that the new password is correct for both incoming and outgoing servers?

Yes. Windows Mail app works fine for a while after the password has been reset and the application is set to use the new password, it works for many hours - retrieving mail successfully - on multiple occasions. Will double check outgoing (SMTP) and incoming (IMAP) soon. However, I know that both send/receive can be done after the password has been reset & entered into Windows Mail, as it's tested each time - after the reset.

Re: Compromised Account SMS Text Messages

sizzleme — Sat, 16 Aug 2025 22:08:23 GMT

A thought...

The BT account is using the free tier and the mailbox, from memory at least, is using around 20GB. It is my understanding that this was once part of a UK broadband/paid package - but not any longer.

It seems unlikely this might be the cause, since at the very least I would expect an email from BT explaining the limitations.

I will need to check the email storage usage again when I next connect or present.

Re: Compromised Account SMS Text Messages

gg30340 — Sat, 16 Aug 2025 22:19:28 GMT

If the BTMail account holder is no longer a BT Broadband customer or paying for the email through a BT Premium email account the BTMail email email account may have been downgraded to a BTMail Basic account which can not be used with an email client. It can only be used with a web browser.

See link

https://www.bt.com/help/email/bt-email-products

If they are neither of the above and the Windows Mail client/app is polling the email account trying to access the account it may be that the BTMail security has deemed it an unauthorised attempt and has locked the account to block access.

To see if this happening set the Windows Mail client/app to only retrieve email manually and do not use it for a few days instead only using webmail with a web browser to see if that is the problem.

Re: Compromised Account SMS Text Messages

sizzleme — Sat, 16 Aug 2025 22:31:25 GMT

That is interesting and I will most certainly verify this using the method you have suggested. I attempted to find the information that you have kindly linked to but found it difficult to find the related material.

It would have been incredibly helpful if BT had included this information in the SMS messages. I will post my findings here over the coming days.

Many thanks...

Re: Compromised Account SMS Text Messages

sizzleme — Sat, 16 Aug 2025 22:41:54 GMT

Again @gg30340 sincere thanks for your assistance, much appreciated.

Re: Compromised Account SMS Text Messages

sizzleme — Mon, 25 Aug 2025 10:38:12 GMT

I have updates.. with awful news..

Summary of BT Mail Issue
SMS text message is received – usually daily, sometimes more often, occasionally it can take two days. The message advises that the BT email account may have been compromised, and the account has been locked. Log in is not allowed until the password has been reset and codes have been sent via 2FA. After successfully resetting the password with the sent code, another code is then required for successful login.

When the account is locked by BT due it potentially being ‘compromised’, all email forwards are disabled until the account has been unlocked using the steps described above. It is then possible to manually enable the forward and auto reply in the web UI.

Auto forward and auto reply are not the issue since the problem occurs even if these features remain disabled. This issue was also present prior to enabling these settings and has only been enabled to start the process of moving away from BT mail (because of the problems outlined here).

An unrelated but equally critical issue is that all emails sent from @icloud.com email addresses are not received in the inbox of the @btinternet.com address. No delivery failure notice is received by the sender, and the email is not in the spam folder of the recipient. The email simply vanishes into the ether.

Eliminations & Fixes Attempted
All email has been deleted from the account – so no space is now used – just a few megabytes.

The email account has been removed from Outlook and the iPhone Mail app. When removing from new Outlook on the Windows platform, the option to remove account from all devices was selected – even though only one device was used. The iPhone mail app wasn’t working anyway (presumably since moving from a BT paid account by way of being active broadband customer a few months ago to now using a free account).

Disabled auto forward & auto reply in web UI.

Updated MyBT account with different email addresses/login, so it no longer uses the same email address as the account that is being locked by BT.

Updated the 2FA methods – to use a new authentication email address.

Re: Compromised Account SMS Text Messages

sizzleme — Mon, 25 Aug 2025 11:35:53 GMT

I have just re-added the account to the New Outlook on Windows. It is my understanding that this does not use the IMAP protocol:

The New Outlook app doesn’t behave like “classic” Outlook. It’s not a full-blown IMAP/POP/Exchange client anymore — it’s essentially a wrapper around Outlook.com’s backend. When you add a non-Microsoft account (like BT, Gmail, Yahoo), New Outlook usually connects via OAuth / web protocols or sometimes through a Microsoft-managed relay service rather than you setting up IMAP directly.

Anyway, I added it so it could be removed again - making sure there's no OAuth token or session still attempting to connect.

I notice that there is quite a lot of marketing emails/spam received in the inbox for this account. I couldn't imagine this is causing the issue.

Any assistance would be much appreciated.

Re: Compromised Account SMS Text Messages

Peter_W — Mon, 25 Aug 2025 12:16:07 GMT

Good afternoon @sizzleme.

I'm disappointed to hear that you're still encountering issues here.

As @gg30340 mentioned, if they are now on a BT Basic email account, this isn't designed to work with any external client, which would include Outlook too.

If they try logging in via BT Webmail directly, are these issues still present?

Peter

Re: Compromised Account SMS Text Messages

sizzleme — Mon, 25 Aug 2025 12:39:36 GMT

Yes. As I mentioned, I have completely disabled/removed all email clients; Outlook, iPhone Mail app, everything. The only way of accessing email now is through the web UI. Issue is still present.

I know it's a free "basic" account, but what good is a basic email account if can't do basic stuff?

Also, I realise that BT want the user out or paying, but why would someone want to spend money with a provider that has daily issues? Does not inspire confidence. Beyond disappointed.

I could post what ChatGPT had to say about the issue but it's rather long and don't want to make the thread any longer than necessary, the TLDR was - migrate & run!

Re: Compromised Account SMS Text Messages

sizzleme — Mon, 25 Aug 2025 12:47:42 GMT

@Peter_W I notice that this thread is marked 'solved'. Not sure if I can change this, as a moderator are you able to please change the status of this to unsolved? Many thanks.

Re: Compromised Account SMS Text Messages

Peter_W — Mon, 25 Aug 2025 13:08:07 GMT

@sizzleme I've removed that solution for you now 😊

So just to be 100% sure should we need to explore this further, it's now only via Webmail that you're trying to access this, and when you're using this it's still locking you out and giving the compromised messages?

Peter

Re: Compromised Account SMS Text Messages

sizzleme — Mon, 25 Aug 2025 13:18:33 GMT

@Peter_W Yes, that's correct - only using the BT web UI for email. No email clients are being used.

The issue has occurred twice more since removing the account from all email clients - and been through the process of resetting the account password on each occasion - all while only using the https://email.bt.com/mail interface to access emails. Happened yesterday and this morning.

Thanks for changing the status - much appreciated.

Re: Compromised Account SMS Text Messages

sizzleme — Mon, 25 Aug 2025 13:27:33 GMT

I feel it's reasonably obvious what is happening:

Free BT accounts are a common target for credential-stuffing attacks. Hackers try old password leaks against them.

Even setting a strong, unique password, BT’s system may still see repeated failed attempts (by bots) and lock the account as a precaution.

The “compromised” status isn’t always proof of a hack — often it’s just failed logins from bots.

Attempted fixes (resetting 2FA, unlinking MyBT login, disabling forwarding) but the underlying trigger is BT’s security system, not something under our control.

Is it even possible to use the BT premium email service any longer? Correct me if I'm wrong, but even new BT subscribers can no longer sign up for BT email? BT appear to be winding down their email platform?

Re: Compromised Account SMS Text Messages

licquorice — Mon, 25 Aug 2025 13:37:37 GMT

Free BT accounts are no more a target than any other. How would the hacker know which are free and which are not in order to target them.

Re: Compromised Account SMS Text Messages

gg30340 — Mon, 25 Aug 2025 13:48:10 GMT

You can still get BT Premium email but there is nothing premium about it. It is just the standard BTMail with a price tag of £7.50 and as against BTMail Basic, you can use the account on email clients and email apps.

As regards BTMail winding down.

BT stopped supplying an email service to new broadband customers in Oct 2020. They also stopped existing customers who had not started a BTMail account prior to that date from being open an email account.

As most ISPs have stopped their email service it would be fair to assume that BT will no doubt follow suite at some time in the future however there is no official word from BT regarding this so at the moment everything is just assumption.

As regards stating "Free BT accounts are a common target for credential-stuffing attacks. Hackers try old password leaks against them". The problem of having accounts locked or hacked, given the millions of BTMail users, does not appear any worse than any other free email services unless you have figures to show otherwise.

I suspect that the problem is that BT security algorithm is over zealous on some peoples accounts while not on others. This may be because the users who seem to constantly have this problem has been hacked previously or they have opened spammers emails or responded to phishing attempts which attracts further spam and phishing attempts which makes them more susceptible to more attacks and as such the BT security system lock them down.

Re: Compromised Account SMS Text Messages

licquorice — Mon, 25 Aug 2025 13:51:21 GMT

I still suspect erroneous attempts by someone with a similar email address as suggested by @gg30340 in message4.