Compromised Account SMS Text Messages

[swusr2025]

Hi there,

Every day I receive an SMS text message advising me that my Email account has been compromised. After receiving the message, I am no longer able to access my email account until I have reset the password. This prevent me from using the Windows Mail application until I reset the password via the web user interface.

I have 2FA enabled for the account.

If anyone has any idea why this is happening it would be of great help.

Thanks.

[licquorice]

Are you using a VPN?

[sizzleme]

Thanks for the reply.

No we are not using a VPN, but the email is being accessed from in the web UI and mail client in Jersey, Channel Islands. From what I can tell, it doesn't seem to be happening as a direct result of checking for or retrieving email in the Windows Mail app.

It can work happily for many hours (usually around one day) then the message arrives and the account password needs to be reset.

[gg30340]

Do not post it but is your email address something that could easily be similar to another person's with a change or omission of a digit because it could be that some is just trying to log onto their own email address but have made a mistake when entering it.

Have you checked that you are entering the correct email password given that you have had to change it so many times?

Did you ensure that all your devices you use had the password changed to the "new" one?

Have you checked that if you use a web browser to log on that if you use the browser's save passwords function that it is using the "new" password?

Have you checked on Windows Mail that the new password is correct for both incoming and outgoing servers?

[sizzleme]

Thank you for your reply...

I am assisting the original poster with this, but will try to answer with the information I have thus far..

Do not post it but is your email address something that could easily be similar to another person's with a change or omission of a digit because it could be that some is just trying to log onto their own email address but have made a mistake when entering it.

Email address is a name followed by three digits. Anything is possible, but I don't think another user is using a similar account and attempting to login every day with wrong details.

Have you checked that you are entering the correct email password given that you have had to change it so many times?

Yes. The details are entered using a password manager and are not entered at all until the SMS message is received.

Did you ensure that all your devices you use had the password changed to the "new" one?

As far as I know, there is only one device (a Windows PC) that is used. Will double check.

Have you checked that if you use a web browser to log on that if you use the browser's save passwords function that it is using the "new" password?

Yes. Using a password manger - with the new details. The web browser is only used after a SMS notification is received instructing that a password reset is necessary. Web browser is not used at all until the notification is received.

Have you checked on Windows Mail that the new password is correct for both incoming and outgoing servers?

Yes. Windows Mail app works fine for a while after the password has been reset and the application is set to use the new password, it works for many hours - retrieving mail successfully - on multiple occasions. Will double check outgoing (SMTP) and incoming (IMAP) soon. However, I know that both send/receive can be done after the password has been reset & entered into Windows Mail, as it's tested each time - after the reset.

[sizzleme]

A thought...

The BT account is using the free tier and the mailbox, from memory at least, is using around 20GB. It is my understanding that this was once part of a UK broadband/paid package - but not any longer.

It seems unlikely this might be the cause, since at the very least I would expect an email from BT explaining the limitations.

I will need to check the email storage usage again when I next connect or present.

[gg30340]

If the BTMail account holder is no longer a BT Broadband customer or paying for the email through a BT Premium email account the BTMail email email account may have been downgraded to a BTMail Basic account which can not be used with an email client. It can only be used with a web browser.

See link

https://www.bt.com/help/email/bt-email-products

If they are neither of the above and the Windows Mail client/app is polling the email account trying to access the account it may be that the BTMail security has deemed it an unauthorised attempt and has locked the account to block access. 

To see if this happening set the Windows Mail client/app to only retrieve email manually and do not use it for a few days instead only using webmail with a web browser to see if that is the problem.  

[sizzleme]

That is interesting and I will most certainly verify this using the method you have suggested. I attempted to find the information that you have kindly linked to but found it difficult to find the related material.

It would have been incredibly helpful if BT had included this information in the SMS messages. I will post my findings here over the coming days.

Many thanks...

[sizzleme]

Again @gg30340 sincere thanks for your assistance, much appreciated.

[sizzleme]

I have updates.. with awful news..

Summary of BT Mail Issue
SMS text message is received – usually daily, sometimes more often, occasionally it can take two days. The message advises that the BT email account may have been compromised, and the account has been locked. Log in is not allowed until the password has been reset and codes have been sent via 2FA. After successfully resetting the password with the sent code, another code is then required for successful login.

When the account is locked by BT due it potentially being ‘compromised’, all email forwards are disabled until the account has been unlocked using the steps described above. It is then possible to manually enable the forward and auto reply in the web UI.

Auto forward and auto reply are not the issue since the problem occurs even if these features remain disabled. This issue was also present prior to enabling these settings and has only been enabled to start the process of moving away from BT mail (because of the problems outlined here).

An unrelated but equally critical issue is that all emails sent from @icloud.com email addresses are not received in the inbox of the @btinternet.com address. No delivery failure notice is received by the sender, and the email is not in the spam folder of the recipient. The email simply vanishes into the ether.

Eliminations & Fixes Attempted
All email has been deleted from the account – so no space is now used – just a few megabytes.

The email account has been removed from Outlook and the iPhone Mail app. When removing from new Outlook on the Windows platform, the option to remove account from all devices was selected – even though only one device was used. The iPhone mail app wasn’t working anyway (presumably since moving from a BT paid account by way of being active broadband customer a few months ago to now using a free account).

Disabled auto forward & auto reply in web UI.

Updated MyBT account with different email addresses/login, so it no longer uses the same email address as the account that is being locked by BT.

Updated the 2FA methods – to use a new authentication email address.