Email account under attack

[ZakMcKracken]

For us this is the second time our BT email address got hacked thanks to BT's poor security. The lost password spamming to guess a 4 digit number is way too easy. It looks like BT now added an additional check, to check if you're human, so the hackers probably have to adjust their software a bit. We're not going to wait for a 3rd time and have now created an email account somewhere else. I however strongly recommend removing any payment details from your accounts linked to BT email, like microsoft (mine was hacked with my bt email account) and wait for an official statement from BT.

[garybs29]

They've already acknowledged it & are saying not to worry - ispreview.co.uk/index.php/2026/09/email-users-of-broadband-isp-bt-suffer-barrage-of-password-reset-messages.html

[ZakMcKracken]

That statement is clearly wrong, or else we wouldn't have had our email account hacked using this lost password method. Also, I would expect a bit more of an official statement considering the scale of this attack, rather than some comment added to another site.

[WSH]

Having had a play with this, I’ve come to the conclusion the real flaw is allowing the OTP code to be sent to the same email address that you are trying to reset.  I’d suggest using a different email for the code or the mobile phone.

[licquorice]

The real flaw is not rate limiting the attempts. 

Which I suspect BT have now done.

[ZakMcKracken]

The fact you only need 4 numbers is also a pretty big deal. They should be 8 or more. It's not like it costs more to ask for more numbers.

[WSH]

Yes, when I commented originally, I assumed it behaved the same as other OTP systems I’ve used.  That is, it resets and generates a fresh number each time.

I was a bit shocked to see it allowed unlimited attempts at same code but to get to the stage of requesting an OTP code I see you also need to have already entered the correct password.  That poses obvious dangers if the code is sent to the same address which has already been compromised.  Once they are into the account it makes it easy for them to reset it and lock you out.  Sending the code to a different address would make that much more difficult.

[licquorice]

@ZakMcKracken  see message 23

[ZakMcKracken]

You need to make 46050 guesses to have a 99% chance to guess the correct number. That's really not that difficult, especially when you can do large amounts of guesses each minute.

[WSH]

Which is why every other OTP system I know resets the code after a failed attempt.