Email pin - text message barrage

[Christopher_G]

Hi @Twitch199 

Please get in contact with our customer support team as soon as possible. They'll be able to check everything from our side to make sure your BT ID is secure.

Chris

[ZakMcKracken]

I had this same issue starting last Wednesday. Contacted BT straight away, which told us to ignore it and that they already gave up. Yesterday started to get many messages again and while talking to BT on the phone, someone was already into my email account. I got back into the account using the same lost password as I could no longer get in. I then found out they already reset my microsoft account. Looking at recent activity it said the hacker was from the united states and had IP 85.203.54.81. No idea what else they have done on the account however. I reported this incident to Report Fraud. Hopefully they can do something about it.

I do think it's ridiculous people can just bombard your account with many lost password requests, while at the same time it only requires 4 numbers to get in. Just waiting to go wrong.

[hackercomplaint]

@Christopher_G is anything being done to stop this from repeatedly happening? If not I will change providers. Sorry but its unacceptable to just say "We want to reassure you that your email account is secure" when clearly hackers are attempting to and in some cases succeeding to hack into people's accounts. Will the security measures be improved or won't they? I have a diagnosed anxiety disorder. The last thing I need is to be woken at 3am by 100 spam messages and the constant worry now that my account could be compromised at any time. Thank you.

[GazR]

Another spam barrage of 539 text messages last night for me.

How on earth is there no system in place to block a blatant abuse of the recover password being spammed by hackers?

Would a moderator kindly answer the following questions for me or advise of the route to make a security complaint?

• Which BT service or authentication process generated these four-digit OTPs.
• What identifying information was supplied to trigger them.
• Whether any OTP was successfully verified.
• Whether any login, password reset, account-linking or account modification succeeded.
• What rate limiting applies to OTP generation/resending.
• What limit applies to incorrect OTP verification attempts.
• Whether multiple OTP challenges may remain valid simultaneously.
• Why the same OTP was repeatedly issued amongst numerous other OTP values.
• Whether BT considers this activity a security incident and what action it has taken to prevent recurrence.

I really hate to be 'that' person, but BT have a responsibility to protect its consumers and our data. From what many of us are reporting, there is clearly some security flaw that is being exploited and so far, the generic responses and continued attacks hasn't instilled too much confidence that BT have taken the issue seriously.

[gg30340]

@GazR 

If you think BT is going to answer those question regarding the email security which would obviously assist spammers and hackers, particularly on a public forum you are going to have a very long wait.

If you want to lodge a complaint I would suggest that you email the BT CEO, you will find her email address with an Internet search.

She will not receive it personally but her Executive Team will and they will respond to your complaint.

[hackercomplaint]

@Christopher_G 

About a week ago I received a text from BT saying "you may have received several BT password reset PINs by text or email. Please ignore them, you do not need to take any further action and sorry for this".

That's great.. but its still happening. I was woken up early this morning around 5am by yet another barrage of over 100 texts. I'm receiving more right now as I write this. This has got to stop. It's incredibly inconvenient and is literally stopping me from sleeping. I can't mute my phone while sleeping as I have a family member with epilepsy and need any urgent calls to me in the night to be able wake me up. I can't block the BT number these text barrages are coming from as I may need it if my account is compromised, which I now feel it probably will eventually be, due to all of these apparent attempts to hack it.

What is being done about this and what can I do, apart from switching to another provider altogether?

Thanks

[hackercomplaint]

over 230 more PIN texts have been sent to me since I posted the previous message. I'm on the phone to BT now and have been trying to sort this out with them for over an hour. Absolutely unacceptable service and treatment of what is a serious issue which is causing me genuine distress as I'm very concerned about my BT account being hacked.

[hackercomplaint]

Update:
After speaking on the phone to a very helpful and professional customer service rep they provided me with the exact details of the message they were sent by superiors regarding these PIN text barrages. He/she was not convinced it was a hacker (the reasoning being that this would be difficult for a lone hacker to achieve - I disagreed) and that it was probably a glitch at their end. Importantly, however, the details of the message from the superiors actually did not confirm whether or not these issues are due to a hacking attempt. It only confirmed (as we know already from this thread) that BT are aware of the issue and are (apparently) in the process of trying to resolve it.

Considering that this has been going on since the middle of last month (September) and is still happening TODAY on Oct 5th (I literally received 200+ more PIN spams while talking to the rep) I'm baffled as to what is taking BT so long to fix this issue, regardless of its origin. The message read to me also said something about them considering changing the "lockout" period that happens when someone requests too many password resets over a short period of time. This doesn't make sense to me as I've been spammed hundreds of texts over a period of well over an hour, on multiple different days now. 

This issue has inconvenienced me so much that I actually initiated the process of switching providers, at which time I got an email from BT;- the usual "Sorry you want to leave us" along with notification that I would be charged an "early termination of contract" fee of over £400. I cannot afford this so I'm stuck with BT for now. I very politely explained my situation, how much it has inconvenienced me (being woken between 3 and 6am by spam texts, multiple times, from an official BT number), and I asked if they could waive the early termination fee. My request was declined. I no longer feel that my email address with BT is secure so I've changed bills etc to go to a different address and will basically put my BT email on the shelf to collect dust. I was advised to just block the number the texts are coming from, but unfortunately its the very same number the rep used to send me, you guessed it, a PIN which I had to use to confirm my identity in order to continue the phone call!! 😂

I will be switching providers as soon as its financially feasible for me. I'm incredibly disappointed with the way this has been handled.

[stupid_hackers]

Its obviously a hacker on an old API, but they will not admit that on the phone as it makes them liable when your account gets compromised and bank accounts drained etc.

Note how these attempts are being paused during working hours and resumed overnight?

All you can do is move away from BT. I will do the same.

[stupid_hackers]

Never mind, it's a current API

https://my.bt.com/s/apps/appsselfserve/index.html#/forgotlogindetails?srfd=y&view=btmail

They are buying recaptcha solves and using this.

There seems to be a mitigation in place:

"The selected recovery option is locked for 2 hours.
Please try again later."

But the attacker gets like 200 attempts before the lock it seems. Not really helpful if they can keep trying hundreds per day.

The pins NEED TO BE 8 digit. This is the ONLY mitigation.