@Scotsail wrote:
If a phishing mail is sent from a genuine BT address, it is reasonable to conclude that the address has been hacked. There must be a way for BT to look into the situation and advise the account holder of the situation by some other means of communication.
Whilst it was unfortunate that your account was compromised it is not always the case that an email purporting to be from a genuine email address has come from a hacked account.
Most emails that purport to be from a genuine email account are "spoofed" email addresses. The reason that scammers do this is because like you, most people let their guard down if they see an email from what they believe to be a known/trusted source.
Recipients of emails can check the actual email address that the email was sent from rather than just the address that it purports to be from. They can do this by "hovering" over the email address. The genuine email address will be then be shown.
If they are using BTMail in a web browser they can highlight the email and then go to "More" in the menu bar then "view source". This will show header of the email and its genuine email address along with its journey path to their email account.
As regards BT advising the account holder that their email account has been hacked. If BT become aware of a hacked account or there being suspicious activity, such as numerous incorrect log on attempts, they will lock the account and advise the account holder. That is assuming the account holder has supplied an alternative email account within their profile in their MyBT. If they have not done that the account will be locked until the account holder changes the password.
However, if an email account has been hacked where the hacker has obtained the account details through a phishing scam, BT are obviously unaware that the account has been compromised because the hacker is using the genuine log on and password as supplied by the unfortunate victim of the phishing scam.
In this instance, when the victim discovers what has taken place all that they can do is advise all their contacts that the email address has been compromised and that any email emanating from it should be treated as spam and deleted immediately. The victim should then stop using the email email account.
The victims contacts will no doubt still receive emails purporting to be from the compromised account but they will be spoofed emails. The reason that they will still get them is because the scammer will have harvested the victims contacts list and when it has been stolen it can not be un-stolen and can now be used/sold on by the scammer as often as they like.
Because the email account has been "spoofed", the scammer can use any return email address that they want and by doing this the original victim is unaware that their email account has been compromised because all replies to the spoofed email do not reach their email account because the email did not come from them.
The best advice is to treat all emails as suspect, never click on any links within the email without hovering over the link to see where it will take you and even then don't. Use the genuine web site rather than the link if you need to check or confirm something in the email.
