BT website allows anyone to add services to an account with a phone number and postcode
A security flaw allowing anyone armed with your phone number and correct UK postcode to add services to your BT account has been spotted by The Register. The site showed how easy …
Context & Ripple Effects
The flaw, spotted by The Register, lands on a BT consumer web operation that has been expanding since 2007, when BT launched its FON-based WiFi sharing scheme and urged customers to share their home broadband connections. The self-service account tooling built up around that consumer push turns out to treat a phone number and a correct UK postcode as sufficient proof of identity to add billable services.
The story travelled fast for an unpatched-at-reporting bug: Engadget, The Next Web and ITProPortal all carried it the same day, marking carrier self-service portal authentication as a recurring press beat rather than a niche disclosure.
First-order effects
- Any BT customer whose phone number and postcode are known — and UK postcode lookup tools make the latter easy to obtain — can have services added to their account without consent, creating direct billing-fraud exposure and a cleanup burden for BT's support channels.
Second-order effects
- Rival UK ISPs and mobile carriers face immediate pressure to audit whether their own self-service flows authenticate on equally guessable knowledge factors, since the same pattern is cheap to check for once published.
Third-order effects
- If knowledge-based verification remains the norm for carrier account changes, account takeover via semi-public data becomes a repeatable attack class across telecoms, pushing the industry toward out-of-band confirmation for any billable action.
The trend: Telecom self-service portals are being forced to stop treating semi-public personal data like phone numbers and postcodes as proof of identity, as account takeover becomes a systemic weakness across carriers.