This topic

Email account under attack

mathewjg — Mon, 14 Sep 2026 10:05:16 GMT

I have had over 500 text messages giving me a one time code to verify my btinternet mail account. I tried to change the password but the system first requests confirmation via email and then sends the same text message with verification code. Its difficult to know whether the code is the one generated for me or if it for whoever is trying to hack my account. It seems impossible to speak to anyone about it.

Re: Email account under attack

mathewjg — Mon, 14 Sep 2026 10:58:20 GMT

I now have over 1000 text messages and it seems impossible to speak to BT. I tried to change the password from my laptop using web mail and now I am locked out with the sign in page looping. I can still read emails on my phone using the app. Just to make my situation more difficult, I have upgraded my phone and all the apps that were using fingerprint login now require that I enter a password.

Re: Email account under attack

Christopher_G — Mon, 14 Sep 2026 14:07:25 GMT

Hi @mathewjg

We are aware that some customers have received a large number of password reset pin messages and we are actively investigating the cause of this. If you have received multiple messages like this, please ignore them and remain vigilant for any unusual activity with further messages or unexpected calls.

We want to reassure you that your email account is secure, and you do not need to do anything at this time.

Chris

Re: Email account under attack

wictod — Mon, 14 Sep 2026 17:57:33 GMT

I have just about 50 texts sent to my phone as well... I am currently logged in to email.. i assume this is happening to multiple users?

Re: Email account under attack

Twitch199 — Mon, 14 Sep 2026 19:38:36 GMT

Yes I've also put a thread on the site, seems like some brute force attack. The 4 digit pin is the vulnerability here, and changing password doesn't stop them.

Hopefully BT will act quickly.

Re: Email account under attack

WSH — Mon, 14 Sep 2026 19:47:36 GMT

I don't know if it offers any reassurance but the four digit pin shouldn't really be a problem.

If it's like other OTP systems, it issues a new number when you enter the wrong number. They only have the one chance to get it right. Each time it sends a new number they have a 1 in 10,000 chance of guessing it correctly.

Re: Email account under attack

Twitch199 — Mon, 14 Sep 2026 19:52:55 GMT

Yes but they are doing a couple of hundred attempts each day, and then across multiple user accounts, so 1 in 10,000 is easily achievable for the hackers. 4 digit pin is rather easy to brute force - this is why most sites don't use it and I guess why BT mail is the focus of the attack.

Re: Email account under attack

wictod — Mon, 14 Sep 2026 19:57:06 GMT

So how is this hack working.. when I enter my email I have to verify my password before I can gain access with the pin.. are we saying all these accounts being affected have had their passwords compromised?

Re: Email account under attack

WSH — Mon, 14 Sep 2026 20:00:05 GMT

No, each time they get it wrong they are back to square one, each and every account they try, each and every time.

Yes, it's possible, that just by chance, they may hit lucky one time but each time they have only a 1 in 10,000 chance. They don't get the opportunity to work through every combination, one at a time.

Re: Email account under attack

wictod — Mon, 14 Sep 2026 20:01:59 GMT

Ok maybe I'm missing something here but my current way of logging into email requires me to add a username and password, then I get an option to receive a pin over text to authenticate and gain access to my mails... I can only get the pin / text option after I've entered my password..

Re: Email account under attack

Twitch199 — Mon, 14 Sep 2026 20:06:02 GMT

Nope - if you hit "forgot password" it sends a pin and if you get the pin you can change the password.

If you do this on the BTID then you can change the mobile number associated with the account.

They are not entering usernames and passwords, just username and forgot password then trying the luck/brute force to get the pin right.

This is why pin should be at least 8 digits.

Re: Email account under attack

wictod — Mon, 14 Sep 2026 20:09:02 GMT

Ok I got it.. thanks for clarifying.. yeah a 4 pin code isn't the strongest is it..

Re: Email account under attack

WSH — Mon, 14 Sep 2026 20:13:11 GMT

Yes, that is possible if they already have your username and password but they would still be in the position of having a 1 in 10,000 chance of getting it right and each attempt would be 1 in 10,000.

It is more likely they are using the "Forgotten password" facility to try to reset your password to something they know. If that is the case they still only have a 1 in 10,000 of getting it right each time they try.

Edit: Your concern is only true if the OTP is a static number that is the same each time. In all the OTP systems I know, it is not. It resets after each attempt, generating a new number.

Re: Email account under attack

Twitch199 — Mon, 14 Sep 2026 20:11:04 GMT

I'm up to about 300 texts received in 24 hours - and as was put by another user, there are many texts with the same 4 digit pin and not in sequential texts - so this is also a little strange as would suggest the random generation is not so random (but that a guess on my part)

Re: Email account under attack

Twitch199 — Mon, 14 Sep 2026 20:17:28 GMT

Yes so if the hacker keeps his "guess" static, on average every 10,000 requests will give him access. I've had 300 such requests in 24 hours. If they have done that on 100 email accounts then it would on average have allowed them access to 3 accounts

Re: Email account under attack

WSH — Mon, 14 Sep 2026 20:23:28 GMT

OK, that might work, but if you are going put that much effort into hacking an account there needs to be some significant gain when you get in. I just don't see the average joe's email account being worth that effort.

I'll leave you to it, anyway. I was only trying to offer some reasurance.