Is two-step authentication now mandatory? No option to switch it off.

[daveattavistock]

I logged into MyBT using my wife's mobile number.

Once in I went to 'My Details', '2 factor authentication', 'Edit' and then the only option available is to change the mobile number.

There is no option to switch 2 factor authentication on or off... nor are there currently any other options.

I then changed the phone number to my landline number.

This means that the incoming SMS message is relayed to me on the landline by voice.

This also means that when my wife's mobile is not available I can still access MyBT using my desktop computer  and the landline.

[gg30340]

@daveattavistock 

Did you try checking/changing your recovery details using a web browser and not the app as I suggested in mesage 79?

[daveattavistock]

Hi,

I'm using a desktop and a web browser.

[daveattavistock]

I've also had a direct response from BT Executive Complaints stating that 2 factor authentication is 'currently' only usable via a mobile phone number now (although they did suggest using the landline / SMS vocal message workaround}

[gg30340]

@daveattavistock 

Re read what I posted. I asked if you had tried changing your RECOVERY contact details.

I receive a choice when I logon of the PIN going to either my mobile or email so somebody is wrong about it only going to a mobile and it isn't me!

[daveattavistock]

This is doubly confusing.

I guess you are talking about 'Contact Details' and 'edit contact details' where it talks about inserting an email address and mobile number for recovery purposes in case something goes wrong.

Something has not gone wrong...I don't want another unnecessary email address (BT will not allow you to use your main email address) and I don't have a mobile phone.

BT has made an absolute 'pig's ear' of the login process. It is hopelessly over-complicated and time consuming.

Having had a reply from BT Executive Complaints I am now at liberty to raise this issue directly with Ofcom on the basis that BT is clearly discriminating against their online customers who do not have a mobile phone by not making a provision for them.

[chrisjp]

"This means that the incoming SMS message is relayed to me on the landline by voice.
This also means that when my wife's mobile is not available I can still access MyBT using my desktop computer and the landline."

Is this voicemail to your landline phone system for relaying the login code to you working? If yes, there doesn't appear to be a problem because you are using BT's alternative to sending the code to a mobile.
If that's the case why are you going to raise a complaint with Ofcom? BT are not apparently discriminating against you.

[gg30340]

@daveattavistock 

It is those Contact details that BT would appear to be using for the 2FA or at least in my case it is those details that I have entered which BT are using to give me a choice to have the PIN sent to either the email address or the mobile phone that I entered.

As I have pointed out how on earth could BT use the email address that you are wanting to log onto to be the email address that the PIN is sent to. You need the PIN to log on so you would never be able to get the PIN!!  You have to supply a secondary email address.

The email address that you would need to enter is not "another unnecessary email address". It is a necessary email address in two ways, first if something goes wrong with your main email address and secondly to enable you to receive a a PIN for the 2FA of your main email account.

As it would appear that you do not want to even try this I will happily leave you to it and look forward to hearing how you get on with Ofcom who will no doubt say something along the lines that it is BT's email system and it is up to them how they wish to secure it and you are under no obligation to keep using it if it does not meet your needs.

[daveattavistock]

There seems to be some confusion here.

The BT email system is not protected by 2 factor authentication at all.

I can access BT  emails by just entering my password.

It is the MyBT section which is covered now by mandatory 2 factor authentication.

It is only if I need to access my BT bills that I have to navigate the 2 factor authentication system and then spend what seems like hours wandering the confusing multi-layer levels and dead ends that is the BT website.

[daveattavistock]

I'm raising a complaint with Ofcom and the Communications Ombudsman because BT is misleadingly giving the impression on its MyBT website that you have to possess a mobile phone in order to navigate the 2 factor authentication.

I only found out about the voice-backed SMS option after some dialogue with BT Executive Complaints.

BT Executive Complaints also said that the official BT email I received on 1st July, saying that verification codes could be sent to mobile phone or email, would have to be corrected and reissued to remove the reference to 'email'.