This topic

Login portal bypasses 2FA

Joe95 — Sun, 16 Aug 2026 18:09:50 GMT

Hi,

I've just discovered something quite concerning when logging into my btinternet email. When using this page from the BT website: https://prod-btemailauth.bt.com/81522fe7-47cf-4713-bdb7-b6f7bfe421a6/b2c_1a_rpbt_signin/oauth2/v2.0/authorize?client_id=bf4e9e5e-0d73-46b3-ad02-06f335bd5105&scope=bf4e9e5e-0d73-46b3-ad02-06f335bd5105%20openid%20profile%20offline_access&redirect_uri=https://email.bt.com/mail/saf/sso.jsp&response_type=code&state=7S2I17DbYdeinjG70Gp

This appears to completely bypass 2FA. I've tried it on various browsers and networks. Does anyone else experience this?

Re: Login portal bypasses 2FA

barnpiece — Sun, 16 Aug 2026 18:24:57 GMT

I had to use 2FA every time, but in the last week or so it has allowed me in without needing a code.

I think that they've changed things now so that it will let you in once it 'knows' you.

I use https://www.bt.com/email to access webmail.

Richard

Re: Login portal bypasses 2FA

shakey1981 — Sun, 16 Aug 2026 19:34:08 GMT

use thunderbird Microsoft store

email settimgs of course you will need to know your passwordhttps://www.bt.com/help/email/manage-email-account/manual-settings/what-are-the-settings-for-outgoing-and-incoming-bt-email-servers

Re: Login portal bypasses 2FA

Joe95 — Sun, 16 Aug 2026 20:23:36 GMT

I currently use Apple Mail and that’s fine. I just meant the web portal seems to completely bypass 2FA which is concerning.

Re: Login portal bypasses 2FA

Joe95 — Sun, 16 Aug 2026 20:43:36 GMT

Yeah it bypasses 2FA for this link also. It seems to be specifically localised to email. Logging into myBT triggers 2FA every time. The email login not triggering it bit concerning if your password is compromised.

Re: Login portal bypasses 2FA

WSH — Sun, 16 Aug 2026 21:08:10 GMT

I’m not sure how BT are doing it, but usually in situations like this, the connecting machine is recognised via something like its MAC address after the first time it connects.

For example, my credit card provider’s site asks if I want to “trust this device” the first time I connect and pass 2FA. Subsequently, it does not use 2FA again for that device.

You will probably find that if you try to access via another machine 2FA will be invoked again. Someone would need your password and that particular machine to get in.