delete old btinternet email address

[mikedesign]

I have an old btinternet.com email address that is no longer used by myself, it turns out this email address has been in data leaks etc and I'm not exactly sure if something dodgy is going on  but I have to reset the password a lot lately , I would like to delete it and close the account ,it has been around for about 20 years

 BT support say they cannot do it as i have no services or broadband , its the free basic account you get given when you no longer use BT services

any one else try and shed some light on it? or managed this

[licquorice]

If you stop accessing it, it will get deleted after 90 days.

As long as you are not using it, it doesn't really matter whether it is deleted or not.

[mikedesign]

we aren't sure if its being accessed elsewhere I get 2fa codes sent to my phone recently and don't access it at all as a rule it was a zombie, it hasn't been accessed by me in the last 2 years so not sure how true the 90 day thing is , just recently weird stuff has been occurring and it was forgotten about until then

[Alex_H]

Hi @mikedesign,

Thanks for visiting the BT Community 🙂

It is correct that we cannot manually delete a Basic BT E-mail, only Standard or Premium, but it would be deleted automatically after 150 days of there being no logins, you can find the full details of that here What is the usage policy for BT Email? | BT Help

If you believe the e-mail had been compromised, if they had logged in that would have prevented the e-mail address being deleted for inactivity. As long as you have re-secured the account by changing to a new password and then choose not to login again, the e-mail address should be deleted after 150 days. 

Alex

 

[SirLoin]

This seems crazy. Many older people use these accounts and are vulnerable to hacking. I know someone who has been hacked so I added 2FA, but the hacker is still on the account and won't ever be thrown out.

Is it correct that BT's only answer is don't log in for almost 5 months and they will then be thrown out? How much damage will be done in that time?

[SirLoin]

The btinternet.com has two major vulnerabilities that could and should  be implemented by BT that means, once accessed, hackers are free to continue.

Firstly, once an email is hacked you can change passwords, add 2FA etc. but it will never log someone out who is logged in.  Therefore once a hacker is in you can't stop them from adding forwarding addresses etc.

Secondly, if you have a basic BT internet.com account, you can't even delete that account. The guidance is don't log in for 150 days (almost 5 months) and the email will be automatically deleted.  I don't know if this is actually logins or whether it stays active as long as they are using it, but giving free reign to a hacker for 5 months is nuts.

Many older people use these accounts and are vulnerable to hacking, with no way to log out from all active sessions or close the account promptly. This will then lead to more emails being sent to more vulnerable people, continuing the chain of misery.

BT needs to get this fixed as a matter of priority, more from a moral obligation than anything else.

[gg30340]

@SirLoin 

How do you know the hacker is still on the account?

Assuming the email account is sending spam or phishing emails are you sure that the email address is not now being spoofed order to sent spam etc.

If that is happening have you check any of the email headers that have been received from the account to see if it is coming from the hacked account or if it has been spoofed?

[SirLoin]

When we delete the forwarding address, it gets added back on. We got a notification saying it has been removed then when we log in again it has reappeared.

We have been on the phone with the security team and it is a known problem with btinternet emails. Yahoo, apple, Google and Outlook etc all give you an option to revoke tokens on all sessions (if you click on anything it asks you to go through the password process again), bt doesn't do this.

If you have a basic account, which most people do as they were moved on to BT, you don't even have the option to delete your account. Instead it will be deleted after 150 days of not being logged in to

[licquorice]

Did you change the email password, if not the hacker will just be able to configure the forwarding as fast as you remove it.

The only people on Basic Mail are those that do not have a BT broadband account. BT customers have Standard mail. Premium mail is just the name given to Standard mail for non BT customers paying to keep Standard mail.

I get heartily sick of folks on here equating age as a reason for not being tech savvy and susceptible to hackers, it has nothing to do with age. 

[SirLoin]

Yes the password was changed as well as changing the 2FA method.

With regards to the account, BT forced them off BT broadband and on to EE when they took over EE. They didn't have a choice.  Therefore they automatically lost the option for standard and premium options unless you pay for it.

I know not all elderly people are tech illiterate, but as a fraction, many of them are less tech savvy. It is partly proven by the fact that when I initially deleted the forwarding, many elderly people were replying to the obviously dodgy email, whilst the younger people contacted via WhatsApp, text, phone etc.

It still does not excuse the poor quality of the BT systems that once you are hacked, there seems to be no way to stop access to the account. There was a 90 minute call to BT yesterday and another scheduled today to try and resolve it. As they said they couldn't log them out.