This topic

Repeated one-time codes - scam??

roxburd — Fri, 13 Nov 2026 11:03:38 GMT

Hi all,

I keep getting SMSs, supposedly from BT, with one-time login codes in. Three times this morning and a couple of times a few weeks ago. I didn't request them.

How common is this? And is there anything I can do to stop them?

The SMS says "Hello, BT here. Your one-time code to sign in securely is dddddd."

Yes, I understand one-time codes - I have worked in designing online security so I do get what they are and what they're for.

If they really are from BT, then they are likely triggered by someone typing in my identifier and requesting a code - so it gets sent to the number associated with my identifier. Yes, it could be someone mis-typing their own identifier.

Last time it happened, a few weeks ago, I followed the advice in the SMS and went to the URL it gave for people who got codes they didn't request (accounts.bt.com/bt-help), only to find that it was entirely unhelpful. So I logged in to my BT account proper only to find no record of the codes being sent and no way to turn them off.

The fact that I could log in meant that whoever had requested the codes had not managed to get in and change my password. Changing my password now will not reduce the one-time codes.

Receiving the one-time codes is unsettling because every time, it could be part of an attack/scam.

So, my questions:

1) How do I know these codes are really from BT? My account gives no hint of them having been sent. The SMS comes from -BT-... that could be spoofed.

2) Is there a known scam that involves requesting these codes - or faking the sending of these codes? Are these messages a softening-up, gaining trust, so that I will follow directions in a later active payload?

3) Can I switch off the option to receive one-time codes? They're really annoying.

I would like to say that I'm disappointed that it should be BT causing me this anxiety and providing no support. But no-one's surprised, there, huh.

Re: Repeated one-time codes - scam??

roxburd — Fri, 13 Nov 2026 11:14:13 GMT

Follow-on: Aha. When I request a one-time code, having pretended to forget my password, it is sent via email, not SMS. Does that mean the one-time codes I'm receiving by SMS are not for my account? I would like to imagine that BT is consistent... Oh... yeah, I suppose it could still be my account. Alternatively, someone could have mistyped their own phone number when they configured their account...

Is there any way to find out what's going on?

Re: Repeated one-time codes - scam??

gg30340 — Fri, 13 Nov 2026 11:23:13 GMT

These codes are sent to you so that you need to use them to access your account.

By doing that it prevents scammers/hackers getting into your account without knowing the code.

If you are getting the codes it mean someone is trying to get into your account. If it is not you wanting into the account then obviously do not use or give out the code to anyone who may ask for it.

If the code was not in place your account may well have been hacked by now.

You can not turn the 2FA codes being on your account.

BT will only send you a code at the same time as you are trying to access your account or make changes to it such as changing your password.

Re: Repeated one-time codes - scam??

roxburd — Fri, 13 Nov 2026 11:46:07 GMT

https://assets.theregister.com/2026/09/16/20265

BT Email users hit by barrage of unsolicited password reset PINs - Wed 16 Sep 2026

In my particular case, though... it was a relative trying to get access to a sub-account. What a shame BT can't make these comms clear enough to convey value. And sends them to the wrong address. I understand that good security requires secrets, sure. But security by obscurity is broken by design, as Bruce Schneier posited. And I believe Schneier was even working for BT when he said that. But this is just obscurity through poor design, rather than intended to enhance security. Extremely poor.

Re: Repeated one-time codes - scam??

gg30340 — Fri, 13 Nov 2026 12:02:26 GMT

BT have only sent them to the wrong address because you appear not to have followed the correct procedure when giving an email account to a friend or relative and as such you still manage that account and are responsible for the 2FA and any changes made to that account such as changing the password.

Had you "gifted" the email account to the relative as per the correct procedure in the following link your relative would have needed to set up their own BTID and MyBT in order to "receive" the "gifted" email account and would have then been able to manage the account without you being involved and also they would have set up their own contact addresses for the 2FA process.

See link about "gifting" email accounts.

https://www.bt.com/help/email/manage-email-account/account-set-up/how-do-i-create-and-activate-a-new-bt-email-address-

See this link about changing where the 2FA code is sent. This applies to all the accounts that you manage, ie not ones you have "gifted" using the correct procedure because the person you gifted the account to would manage the email account on their own and set where the codes are sent without involving you.

https://www.bt.com/help/security/two-step-authentication

Re: Repeated one-time codes - scam??

iniltous — Fri, 13 Nov 2026 12:25:17 GMT

As you state , it’s possible someone has inadvertently put your mobile phone number into their BT account as the ‘contact’ number for themselves, if they then need to authenticate gaining access the authentication ‘code’ is sent to you because of the error they made in setting up their account.

As far as resolving this, unless the other account holder wonders why when BT say we have sent a code to the linked mobile number that never actually arrives and so investigates why it doesn’t turn up (and realises the error made hopefully corrects the recorded number ) I’m not sure how you can avoid these unwanted texts

Re: Repeated one-time codes - scam??

chrisjp — Fri, 13 Nov 2026 13:06:12 GMT

I'm not sure that anyone can actually register an incorrect phone number for their account.

When you first try to register your phone number, a code is sent to it, and the phone number will not be registered to you until you've entered this code.

So the code appearing on someone else's phone should be a one time event - unless the registerer continues to try registering the same wrong phone number repeatedly - which seems unlikely beyond 3 or 4 tries.

Re: Repeated one-time codes - scam??

iniltous — Fri, 13 Nov 2026 13:18:32 GMT

I can’t say for sure , but I think ( in my case ) my mobile number ( the same number for 20+ years ) was registered with BT long before BT started sending ‘codes’ to it .

Re: Repeated one-time codes - scam??

gg30340 — Fri, 13 Nov 2026 13:38:04 GMT

It is more likely that one of the email addresses that the OP has given to a friend or family member without having followed the "gifting" procedure is triggering his 2FA number for some reason such as they are trying to change the password or if it is not a friend or family member it is possibly an automated computer hack trying to gain access to the account which is triggering the 2FA.

If it was a scammer they normally trigger the 2FA by trying to change the password using the "forgotten" password route while at the same time contacting the account holder and purports to be from BT.

The scammer informs the account holder there is a problem with their account/line or some other story and to "prove" they are from BT they will send a PIN number at which point they trigger the 2FA through the forgotten password system. They then ask the account holder to verify the 2FA number so that "they/BT" are sure they are talking to the account holder.

The account holder tells them the PIN number and surprise surprise the scammer now has full access to the account and all that it holds. They will then quickly change the password to stop the account holder gaining access before they harvest everything useful to them in their money making venture.

The only way to avoid this is never believe any unsolicited caller claiming to be from BT regardless of what message they are telling you and never reveal the PIN number unless it was you that initiated the call to BT.

Hang up and call BT 0330.1234.150 and inform them what has taken place and they will undoubtedly verify that it was not BT.

Re: Repeated one-time codes - scam??

roxburd — Fri, 13 Nov 2026 14:12:06 GMT

It was indeed a relative who had a sub-account. I had set this up for them about 20 years ago... so no, I had not "followed the correct procedure" as you put it - because the 'correct' procedure did not exist when I set it up.

Re: Repeated one-time codes - scam??

gg30340 — Fri, 13 Nov 2026 14:41:45 GMT

@roxburdwrote:
It was indeed a relative who had a sub-account. I had set this up for them about 20 years ago... so no, I had not "followed the correct procedure" as you put it - because the 'correct' procedure did not exist when I set it up.

The correct procedure has been in force ever since BT email system left Yahoo in 2013/14.

This resulted in the new BTMail system and all the BTYahoo email accounts were migrated to that. Customers were informed about the changes within the new BTMail email system and how to "gift" email accounts etc and set up a BTID and MyBT.

It was not compulsory to gift email accounts but it was strongly recommended because at that time the "main" account holder could access/manage all the BTMail accounts that were associated to the broadband account via a drop down box in the "main" email account even if they had a different password. This included any of the sub accounts that may have been set up and given to friends and family that had not been "gifted".

The main account holder can not now access the other accounts via the "main" account but the main account holder is still the manager of any non gifted account as they are deemed to be the main account holders email accounts and are subject to the main accounts 2FA.

The main account holder can change the password and delete the account where as if the account is gifted they can not do that and they do not receive the 2FA PIN.