Have you been called by a ‘BT technical support’ phone scam?

Hi Caroline, I am trying to understand this.

Surely scammers would only have access to your pin if they also had access to your email address on your computer or phone.

Or am I missing something?

Sorry, was trying to précis a complicated process, but obviously shortened it too much. Basically, if you ‘phone BT, they take you through security. One item in this process is for them to send you specifically and instantly formulated PIN in an email or text. If you can read this PIN back to them, that verifies who you are, so the conversation can proceed.

However, such a PIN is also sent when you want to change your password. You put the PIN into the box on the “reset email” page and then you can change your password. The major flaw is that the email containing a password changing PIN is identical to the email containing the security PIN. There is absolutely no indication whatsoever as to why the PIN has been sent, for what purpose, i.e. for security check or password change.

In the case of the scam, the scammers had both my telephone number and email address, possibly from a charity website I help with, but who knows. So, while I was on the ‘phone and when I asked them to prove who they were by telling me my BT account number, they (I know now, but didn’t then!) opened up the “My BT” page on the BT website, put in my email address and clicked on “forgotten password”. This generated the emailed PIN sent to my email address. It is absolutely genuine and generated by BT, and comes from them. However, as the scammers said they were sending me a security PIN, it never occurred to me it could be a password change PIN, so when they asked me for the number, I gave it to them.

Once they had the PIN, they then put this into the appropriate box on the reset password page and hey presto, they could change my password to one of their own and get into my account. From there they could glean all kinds of information, including my account number. They can also get into my emails as well.

Of course, I didn’t know this, so as they were able to give me the information I asked for I assumed they were genuine.

It was a first line BT telephone answerer who told me this, so they have clearly known about this for some time, yet all they have done is “highlighted” the issue, so it can still happen to someone else. Hence my continuing to fight to get it changed immediately.

Hope this helps to clarify.

Thank you for your detailed explanation Caroline, now I understand.

I completely agree with you that BT should differentiate between the two PINs.

I never divulge personal or account information unless I instigate the call. On the rare occasions I have been called, I always call them back on a number I find from a trusted source making sure the line is clear first.

Have you got another email address you can use? If not, have a look at Proton Mail.

Thanks Caroline, that confirms my understanding of your earlier post.

As you say, it was bad that BT knew about that hole in their system but had not remedied it.

Thanks for the idea. Yes, I had thought of that, but as I don’t look at it that other one much, I’d have to try to remember to, otherwise messages could be sitting there for weeks!! Of course, I don’t know how they got my email address and ‘phone number together. It may not have been that. I was interested to read that BT had been hacked. Didn’t know that, so they could have got the info from there, or, indeed, just about anywhere! Insurance companies, shopping websites etc. anyone who sells on info.

At least I am aware, now!

I was interested to read that Matthew Paris had been deceived a couple of years ago, so if it can happen to him, I don’t feel so bad. I am, usually very aware, and can suss out a scam and/or spam email quickly, but they really got me with this one. Fortunately it only ended badly for them!

Hi Caroline,

One way of getting email addresses is via data breeches, when companies are hacked and customer data is stolen.

You can use this website:-https://haveibeenpwned.com/ to see if your email address was compromised in any of several known data breeches.

Thanks for that. Interesting. Of course in the scam I experienced, the scammers would have to know both email and telephone number, which are rarely together. My emails showed up in a couple of breaches, but both many years ago and neither had my home number.

I did reply to this, but it seems to have disappeared! Thanks for this. Interesting. Nothing here that would give email and ‘phone no. together, but I will keep checking.