BT account hack. how is this being done?

grumpycrab

Neighbour had BT account hacked. password, recovery mobile and recovery email all changed. Result - 1. email to address list asking for money 2. replies from these people being forwarded to spammer email address in BT (auto-forward) settings.
Sorted with BT, we thought.  Half an hour later, the auto-forward has been reactivated. How are they doing this!!!  I assume there's malware/key logger on the computer.  OR their router has been hacked (is this even possible).
I've got their computer at my house.  No signs of a repeat problem (auto-forward settings being messed around with).  Bloody hell.

Neil_Jones

Change the recovery mobile and email back to what they should be.

Then change the password, to something more stronger than "apple123" or something that can be cracked in less than the time it takes you to read this.

This might be enlightening:

https://www.passwordmonster.com/

Set up two factor authentication if you haven't already done so..

PHK

Yes, I'd say the neighbour had an easily guessed password or used the same password for multiple services one of which had a data breach. 

Time to get their digital health up to date:

Use a password manager to generate unique secure passwords for each site/app

Turn on 2FA, preferably using a one time code from an authenticator app rather than SMS. 

If you can educate them about being careful what they click on. 

Newcad

It's not particularly a BT problem, it could happen no matter who your internet provider is.

Your neighbours email address(es) and password(s) have been exposed in one of the many data breaches that happen everyday.
So they now need to be changed.

You can check if an email address is known to have been exposed (it's known as being Pwned) here:
https://haveibeenpwned.com/
And you can do the same check for exposed passwords here:
https://haveibeenpwned.com/Passwords

I check my own email addresses (and passwords) at least one a month, and if necessary I'll abandon them and make a new email account.
When buying something. or registering with a website, I will usually use a gmail account and forward the mail from that to my main private email account. It's easy to simply abandon a breached gmail and create a new one in a different name and with a different password.

grumpycrab

Thanks. Yes, the password was simple. Took BT 2 goes to sort it out (MyBT/BT ID part of the account was also hacked).  2FA authentication enabled on mobile; authentication device would have been too much for my elderly neighbour; at least he has a mobile.