This topic

Email pin - text message barrage

Twitch199 — Sun, 13 Sep 2026 20:35:50 GMT

I just got a barrage of pin text messages - there were about 50-70 texts in the space a few minutes. I assume this is hackers, but I thought the BT system stopped issuing these if there were so many requests. If BT is allowed this number of requests in a few mins , then on a 4 digit pin it's just a matter of time untill they guess the right pin. Why can't BT sort this out, at least move to longer pins?

Re: Email pin - text message barrage

stupid_hackers — Sun, 13 Sep 2026 22:33:45 GMT

Just got the same, why is BT still issuing 4 digit pins anywhere?

Really worried hackers are just compromising accounts with this. Got over 100 text messages at once.

Re: Email pin - text message barrage

hackercomplaint — Sun, 13 Sep 2026 23:05:49 GMT

This has now happened to me twice in the last few days. Both times they've spammed over 100 times. BT REALLY need to sort this out and put a limit on the amount of requests for a "one-time pin" that can be made in such a short period & make the pin number longer. Its absolutely ridiculous. If this keeps happening I'll be forced to switch providers. BT, please fix this gaping hole in your security (and mine) A.S.A.P

Re: Email pin - text message barrage

mathewjg — Mon, 14 Sep 2026 10:08:22 GMT

I have over 500 requests today - I wanted to change the password but BT sends a text message which gets lost amongst the multiple other requests.

Re: Email pin - text message barrage

GazR — Mon, 14 Sep 2026 10:24:34 GMT

I've had the exact same last night. Woke up around 1.30am with my phone receiving a spam of verification texts with a 4 digit pin.

It happens to me every now and then. What I find particularly worrying is that BT don't appear to have any sort of anti-spam system in place. Attackers are essentially free to spam non-stop requests without their systems acknowledging there is an abnormal amount of requests.

Of the 127 messages I received over 4 or so minutes, I found it particularly worrying that 10 of the messages contained the same pin code, another number appears 6 times and another one 4 times. The same numbers were not received back to back or one after the other, they were mixed amongst the barrage of messages.

Also - Why a 4 digit pin?!
I immediately got up and changed all my passwords.
None of the verification messages I got sent when changing passwords myself contained a 4 digit number, they were all 6 - So I'm unsure what method the attackers are using to spam the 4 digit pins.

This has been happening on/off for the last 4 years for me.
Unfortunately, nobody seems to really take on board my concerns when I call which is disappointing.

Re: Email pin - text message barrage

mathewjg — Mon, 14 Sep 2026 10:29:12 GMT

I now have over 1000 text messages. There does not seem to be any way to contact BT.

Re: Email pin - text message barrage

GazR — Mon, 14 Sep 2026 10:35:05 GMT

That's awful.
I've had similar in the past. Combined with the stress and worry that somebody is going to gain access to your emails and do whatever they want.

I have migrated around 90% of my emails to a different provider as of last year when BT's response was simply "They haven't got in".
Didn't fill me with confidence that a major ISP and e-mail provider is unable to offer the most basic of protection and gave what I perceived as a shrug of the shoulders.

Change your passwords, make sure 2FA is on, change your BT ID email address also?

Ultimately, consider changing providers who have more robust systems in place.

Re: Email pin - text message barrage

Christopher_G — Mon, 14 Sep 2026 14:04:44 GMT

Hi all,

We are aware that some customers have received a large number of password reset pin messages and we are actively investigating the cause of this. If you have received multiple messages like this, please ignore them and remain vigilant for any unusual activity with further messages or unexpected calls.

We want to reassure you that your email account is secure, and you do not need to do anything at this time.

Chris

Re: Email pin - text message barrage

Twitch199 — Mon, 14 Sep 2026 18:24:56 GMT

And a day later I just got 106 text messages in just a couple of minutes. As I have highlighted to BT before if they get control of the email account then they can change the mobile number on the BTID and thus control the 2fa (as the pin to change the mobile number goes to the email).

This is a massive security hole and BT don't seem to want to do anything about it, it's insane.

Please please go to longer pins and don't allow mobile numbers to be changed via a email code!

Re: Email pin - text message barrage

Twitch199 — Tue, 15 Sep 2026 04:14:51 GMT

URGENT - so the inevitable happened and they got into and changed my BTID password and I'm locked out

Re: Email pin - text message barrage

Christopher_G — Tue, 15 Sep 2026 08:31:36 GMT

Hi @Twitch199

Please get in contact with our customer support team as soon as possible. They'll be able to check everything from our side to make sure your BT ID is secure.

Chris

Re: Email pin - text message barrage

ZakMcKracken — Tue, 15 Sep 2026 19:25:34 GMT

I had this same issue starting last Wednesday. Contacted BT straight away, which told us to ignore it and that they already gave up. Yesterday started to get many messages again and while talking to BT on the phone, someone was already into my email account. I got back into the account using the same lost password as I could no longer get in. I then found out they already reset my microsoft account. Looking at recent activity it said the hacker was from the united states and had IP 85.203.54.81. No idea what else they have done on the account however. I reported this incident to Report Fraud. Hopefully they can do something about it.

I do think it's ridiculous people can just bombard your account with many lost password requests, while at the same time it only requires 4 numbers to get in. Just waiting to go wrong.

Re: Email pin - text message barrage

hackercomplaint — Tue, 15 Sep 2026 21:53:06 GMT

@Christopher_G is anything being done to stop this from repeatedly happening? If not I will change providers. Sorry but its unacceptable to just say "We want to reassure you that your email account is secure" when clearly hackers are attempting to and in some cases succeeding to hack into people's accounts. Will the security measures be improved or won't they? I have a diagnosed anxiety disorder. The last thing I need is to be woken at 3am by 100 spam messages and the constant worry now that my account could be compromised at any time. Thank you.

Re: Email pin - text message barrage

GazR — Wed, 16 Sep 2026 19:11:56 GMT

Another spam barrage of 539 text messages last night for me.

How on earth is there no system in place to block a blatant abuse of the recover password being spammed by hackers?

Would a moderator kindly answer the following questions for me or advise of the route to make a security complaint?

Which BT service or authentication process generated these four-digit OTPs.
What identifying information was supplied to trigger them.
Whether any OTP was successfully verified.
Whether any login, password reset, account-linking or account modification succeeded.
What rate limiting applies to OTP generation/resending.
What limit applies to incorrect OTP verification attempts.
Whether multiple OTP challenges may remain valid simultaneously.
Why the same OTP was repeatedly issued amongst numerous other OTP values.
Whether BT considers this activity a security incident and what action it has taken to prevent recurrence.

I really hate to be 'that' person, but BT have a responsibility to protect its consumers and our data. From what many of us are reporting, there is clearly some security flaw that is being exploited and so far, the generic responses and continued attacks hasn't instilled too much confidence that BT have taken the issue seriously.

Re: Email pin - text message barrage

gg30340 — Wed, 16 Sep 2026 19:29:21 GMT

@GazR

If you think BT is going to answer those question regarding the email security which would obviously assist spammers and hackers, particularly on a public forum you are going to have a very long wait.

If you want to lodge a complaint I would suggest that you email the BT CEO, you will find her email address with an Internet search.

She will not receive it personally but her Executive Team will and they will respond to your complaint.

Re: Email pin - text message barrage

hackercomplaint — Sat, 03 Oct 2026 11:35:31 GMT

@Christopher_G

About a week ago I received a text from BT saying "you may have received several BT password reset PINs by text or email. Please ignore them, you do not need to take any further action and sorry for this".

That's great.. but its still happening. I was woken up early this morning around 5am by yet another barrage of over 100 texts. I'm receiving more right now as I write this. This has got to stop. It's incredibly inconvenient and is literally stopping me from sleeping. I can't mute my phone while sleeping as I have a family member with epilepsy and need any urgent calls to me in the night to be able wake me up. I can't block the BT number these text barrages are coming from as I may need it if my account is compromised, which I now feel it probably will eventually be, due to all of these apparent attempts to hack it.

What is being done about this and what can I do, apart from switching to another provider altogether?

Thanks

Re: Email pin - text message barrage

hackercomplaint — Mon, 05 Oct 2026 10:38:27 GMT

over 230 more PIN texts have been sent to me since I posted the previous message. I'm on the phone to BT now and have been trying to sort this out with them for over an hour. Absolutely unacceptable service and treatment of what is a serious issue which is causing me genuine distress as I'm very concerned about my BT account being hacked.

Re: Email pin - text message barrage

hackercomplaint — Mon, 05 Oct 2026 13:52:59 GMT

Update:
After speaking on the phone to a very helpful and professional customer service rep they provided me with the exact details of the message they were sent by superiors regarding these PIN text barrages. He/she was not convinced it was a hacker (the reasoning being that this would be difficult for a lone hacker to achieve - I disagreed) and that it was probably a glitch at their end. Importantly, however, the details of the message from the superiors actually did not confirm whether or not these issues are due to a hacking attempt. It only confirmed (as we know already from this thread) that BT are aware of the issue and are (apparently) in the process of trying to resolve it.

Considering that this has been going on since the middle of last month (September) and is still happening TODAY on Oct 5th (I literally received 200+ more PIN spams while talking to the rep) I'm baffled as to what is taking BT so long to fix this issue, regardless of its origin. The message read to me also said something about them considering changing the "lockout" period that happens when someone requests too many password resets over a short period of time. This doesn't make sense to me as I've been spammed hundreds of texts over a period of well over an hour, on multiple different days now.

This issue has inconvenienced me so much that I actually initiated the process of switching providers, at which time I got an email from BT;- the usual "Sorry you want to leave us" along with notification that I would be charged an "early termination of contract" fee of over £400. I cannot afford this so I'm stuck with BT for now. I very politely explained my situation, how much it has inconvenienced me (being woken between 3 and 6am by spam texts, multiple times, from an official BT number), and I asked if they could waive the early termination fee. My request was declined. I no longer feel that my email address with BT is secure so I've changed bills etc to go to a different address and will basically put my BT email on the shelf to collect dust. I was advised to just block the number the texts are coming from, but unfortunately its the very same number the rep used to send me, you guessed it, a PIN which I had to use to confirm my identity in order to continue the phone call!! 😂

I will be switching providers as soon as its financially feasible for me. I'm incredibly disappointed with the way this has been handled.

Re: Email pin - text message barrage

stupid_hackers — Mon, 05 Oct 2026 19:45:50 GMT

Its obviously a hacker on an old API, but they will not admit that on the phone as it makes them liable when your account gets compromised and bank accounts drained etc.

Note how these attempts are being paused during working hours and resumed overnight?

All you can do is move away from BT. I will do the same.

Re: Email pin - text message barrage

stupid_hackers — Mon, 05 Oct 2026 20:15:57 GMT

Never mind, it's a current API

https://my.bt.com/s/apps/appsselfserve/index.html#/forgotlogindetails?srfd=y&view=btmail

They are buying recaptcha solves and using this.

There seems to be a mitigation in place:

"The selected recovery option is locked for 2 hours.
Please try again later."

But the attacker gets like 200 attempts before the lock it seems. Not really helpful if they can keep trying hundreds per day.

The pins NEED TO BE 8 digit. This is the ONLY mitigation.