Email pin - text message barrage

[licquorice]

They don't need to access an email account to send spam, they can spoof as many addresses as they like.

As stated, it is to send seemingly personal mails to contacts.

[Chrismc2]

Am I missing something? Why if somebody’s got access to your emails could they not send password resets and access any account of yours that they want that don’t have 2FA?  Spam would be the least of my concerns. 

[stupid_hackers]

That is the main threat, they can use password resets to pivot to your paypal, bank and so on and steal your money.

[hackercomplaint]

"That is the main threat, they can use password resets to pivot to your paypal, bank and so on and steal your money."

Exactly! And having myself been targeted previously not once but twice for bank hacking/fraud this is why I'm particularly perturbed by BT's lacklustre & dare I say it, misleading response! 

In 2024 a hacker managed to spoof a company I'd purchased from a decade previously and withdrew £1000 from my bank. It took me over a month to get my bank to refund the money, which was a stressful ordeal in itself. Meanwhile I had to borrow money from friends to buy food!! Similar to being burgled, which I've also suffered from, these sorts of attacks are actually genuinely traumatising. So when my phone is being lit up, on and off, for now approaching 3 weeks, by yet another hacker trying to invade my privacy and put my finances in danger its pretty stressful. To be gaslit by BT when I phoned them just leads to more dread and a feeling of helplessness. So, again, thank you so much to those in this thread who've provided very useful info. I have learned A LOT, & without that help I may have not realised just how important and urgent it was for me to completely clean out my emails and change all my other accounts to no longer point to my BT email. I'd STRONGLY advise anyone else suffering from these PIN text barrages to do the same, just in case. There might only be a small chance the hackers will be successful on any 1 account, but once successful it could still lead to a significant loss of funds from any bank/paypal/similar linked account.
Notably, there's another nasty variation: if an attacker gets into an email account, they may silently create forwarding rules so password-reset emails continue going to them while the legitimate owner doesn't see them. BT's email does show a notification when this has been enabled, so watch out for that if your email does get hacked.

I apologise to people like Kimberlin if I appear to have been too energetic in my complaints/activity on this forum, but I think perhaps they don't quite appreciate how important it has been for me to get as much info about this as I can, so I know better how to deal with it and mitigate the risk. If I had more spare money I'd just have swallowed the early termination fee and put this to rest. Unfortunately, initially I didn't even realise I'd be charged for leaving BT! Now I know about that I've just got to find a way to afford it, then I'll be out of everyone's hair here, for good. 😥 What an unfortunate and completely avoidable debacle. BT, fix your security, for goodness sake.

[Kimberlin]

@hackercomplaint  You don’t have to apologise to me for anything. With respect, this doesn’t affect me whatsoever. I don’t use BT Mail for starters, I’ve never used an ISP for email.

You can write literally anything you want on this forum expressing your dissatisfaction with BT and its security but it won’t go anywhere because you’re not conversing with anyone at BT on a policy level. You’re literally just expressing your anger at thin air. 

If you’ve learned anything from the advice offered by others here, that’s the best you can hope for. Simply put, other than highlighting and telling the rest of the world what you’ve been through, like the rest of every post made here, it will eventually be absorbed and forgotten. As depressing as it is, the same problems will continue to persist, that’s just the way it is.

Any contract will have terms and conditions relating to early termination, it’s incumbent on the customer to read those terms. If you’ve ever had a mortgage or taken out a loan or had an insurance policy of any sort, are you telling me you’ve never read the agreement first before signing anything? Probably best not to answer that as I’m guessing half the world doesn’t.

I genuinely hope you manage to sort your problems out, just don’t over estimate your expectations.

[hackercomplaint]

"You’re literally just expressing your anger at thin air."

Not quite. The comments in this and other thread(s) have been picked up and reported on by ISP Review, here
https://www.ispreview.co.uk/index.php/2026/09/email-users-of-broadband-isp-bt-suffer-barrage-of-pass...

This helps spread the word not only to potential future BT customers, but also perhaps to current customers who would be otherwise unaware of this gaping hole in BT's security. It makes a google search more likely to lead to useful results.

"If you’ve learned anything from the advice offered by others here, that’s the best you can hope for"

Yes, and its been incredibly valuable information I've learned in this thread and another one on this forum which goes into detail on the statistics/likelihoods of the hackers eventually succeeding. What I've learned here has significantly enabled me to mitigate the potential damage in a way that simply wouldn't have been possible for me without these threads, due to my limited knowledge about this sort of thing. Its made a considerable positive difference to the stress factor also, which is a huge relief given what I've already shared about my past.

"Any contract will have terms and conditions relating to early termination, it’s incumbent on the customer to read those terms"

I read them when renewing my contract but had forgotten about the early termination fee, because I'm extremely busy, and getting old.

"just don’t over estimate your expectations"

Nothing to worry about there. As the weeks have progressed and nothing's been done its become abundantly clear that BT aren't taking this as seriously as they should be. I never had high expectations, but I did have some hope. I've since learned from my experience with their reps (the gaslighting, uneducated hunches peddled as confident fact etc) that only the lowest expectations are the most realistic.

Thanks again.

[andydenyer]

@hackercomplaint
Are you not able to set your mobile to mute at night but still allow calls from certain numbers? That’s how I have mine set up. I realise it’s not going to resolve your main issue, but it could at least help to alleviate one of its impacts. If it’s not a smartphone, though, then that’s a completely different situation, I’m afraid.

BTW, this is about my fifth attempt at posting this, as all previous attempts were rejected as spam for some reason!