Original article ISPreview UK:Read More
Some customers of BT’s UK broadband packages, specifically those that also make use of their included Email platform, have recently begun complaining about receiving hundreds of unsolicited password reset messages (sometimes as many as 1,000 TXTs) – each containing a onetime four digit PIN code to verify their BTInternet mail account.
Firstly, we should point out that a lot of online services use one-time codes (sent to your mobile or a different email) to help verify accounts, although these typically impose restrictions to help prevent automated bots flooding (brute force) such systems with masses of requests (e.g. locking requests after several failed attempts, limiting to only IP addresses from specific networks and other methods). At present it’s unclear what methods BT adopt to protect users.
In any case, The Register today highlighted how lots of reports have emerged on BT’s Community Forum since the weekend (examples here and here), all of which point to customers being flooded with many hundreds of similar messages (the sort of thing you’d expect from bots hitting a poorly protected ‘Forgotten password‘ form) – often within the space of just a few minutes, usually before pausing for a few hours and then restarting again.