Email pin - text message barrage

[Christopher_G]

Hi @Twitch199 

Please get in contact with our customer support team as soon as possible. They'll be able to check everything from our side to make sure your BT ID is secure.

Chris

[ZakMcKracken]

I had this same issue starting last Wednesday. Contacted BT straight away, which told us to ignore it and that they already gave up. Yesterday started to get many messages again and while talking to BT on the phone, someone was already into my email account. I got back into the account using the same lost password as I could no longer get in. I then found out they already reset my microsoft account. Looking at recent activity it said the hacker was from the united states and had IP 85.203.54.81. No idea what else they have done on the account however. I reported this incident to Report Fraud. Hopefully they can do something about it.

I do think it's ridiculous people can just bombard your account with many lost password requests, while at the same time it only requires 4 numbers to get in. Just waiting to go wrong.

[hackercomplaint]

@Christopher_G is anything being done to stop this from repeatedly happening? If not I will change providers. Sorry but its unacceptable to just say "We want to reassure you that your email account is secure" when clearly hackers are attempting to and in some cases succeeding to hack into people's accounts. Will the security measures be improved or won't they? I have a diagnosed anxiety disorder. The last thing I need is to be woken at 3am by 100 spam messages and the constant worry now that my account could be compromised at any time. Thank you.

[GazR]

Another spam barrage of 539 text messages last night for me.

How on earth is there no system in place to block a blatant abuse of the recover password being spammed by hackers?

Would a moderator kindly answer the following questions for me or advise of the route to make a security complaint?

• Which BT service or authentication process generated these four-digit OTPs.
• What identifying information was supplied to trigger them.
• Whether any OTP was successfully verified.
• Whether any login, password reset, account-linking or account modification succeeded.
• What rate limiting applies to OTP generation/resending.
• What limit applies to incorrect OTP verification attempts.
• Whether multiple OTP challenges may remain valid simultaneously.
• Why the same OTP was repeatedly issued amongst numerous other OTP values.
• Whether BT considers this activity a security incident and what action it has taken to prevent recurrence.

I really hate to be 'that' person, but BT have a responsibility to protect its consumers and our data. From what many of us are reporting, there is clearly some security flaw that is being exploited and so far, the generic responses and continued attacks hasn't instilled too much confidence that BT have taken the issue seriously.

[gg30340]

@GazR 

If you think BT is going to answer those question regarding the email security which would obviously assist spammers and hackers, particularly on a public forum you are going to have a very long wait.

If you want to lodge a complaint I would suggest that you email the BT CEO, you will find her email address with an Internet search.

She will not receive it personally but her Executive Team will and they will respond to your complaint.