Email account under attack

[mathewjg]

I have had over 500 text messages giving me a one time code to verify my btinternet mail account. I tried to change the password but the system first requests confirmation via email and then sends the same text message with verification code. Its difficult to know whether the code is the one generated for me or if it for whoever is trying to hack my account. It seems impossible to speak to anyone about it.

[mathewjg]

I now have over 1000 text messages and it seems impossible to speak to BT. I tried to change the password from my laptop using web mail and now I am locked out with the sign in page looping. I can still read emails on my phone using the app. Just to make my situation more difficult, I have upgraded my phone and all the apps that were using fingerprint login now require that I enter a password.

[Christopher_G]

Hi @mathewjg 

We are aware that some customers have received a large number of password reset pin messages and we are actively investigating the cause of this. If you have received multiple messages like this, please ignore them and remain vigilant for any unusual activity with further messages or unexpected calls.

We want to reassure you that your email account is secure, and you do not need to do anything at this time.

Chris

[wictod]

I have just about 50 texts sent to my phone as well... I am currently logged in to email.. i assume this is happening to multiple users?

[Twitch199]

Yes I've also put a thread on the site, seems like some brute force attack. The 4 digit pin is the vulnerability here, and changing password doesn't stop them. 

Hopefully BT will act quickly.

[WSH]

I don't know if it offers any reassurance but the four digit pin shouldn't really be a problem.

If it's like other OTP systems, it issues a new number when you enter the wrong number.  They only have the one chance to get it right.  Each time it sends a new number they have a 1 in 10,000 chance of guessing it correctly.

[Twitch199]

Yes but they are doing a couple of hundred attempts each day, and then across multiple user accounts, so 1 in 10,000 is easily achievable for the hackers. 4 digit pin is rather easy to brute force - this is why most sites don't use it and I guess why BT mail is the focus of the attack.

[wictod]

So how is this hack working.. when I enter my email I have to verify my password before I can gain access with the pin.. are we saying all these accounts being affected have had their passwords compromised? 

[WSH]

No, each time they get it wrong they are back to square one, each and every account they try, each and every time.

Yes, it's possible, that just by chance, they may hit lucky one time but each time they have only a 1 in 10,000 chance.  They don't get the opportunity to work through every combination, one at a time.

[wictod]

Ok maybe I'm missing something here but my current way of logging into email requires me to add a username and password, then I get an option to receive a pin over text to authenticate and gain access to my mails... I can only get the pin / text option after I've entered my password..