Why Am I Getting BT Email Password Reset Codes?
UNSOLICITED PINS • BT EMAIL • ACCOUNT SECURITY • WHAT TO DO
If you are getting BT Email password reset codes you did not request, you are not the only one.
In September 2026, a small number of BT Email customers began receiving repeated unsolicited password-reset PINs by text message or email. Some reported hundreds of codes arriving in bursts even though they had not tried to change their password.
BT says it has implemented mitigations to stop further repeated reset messages and is contacting affected customers. Its current advice is to ignore unsolicited PINs. BT has not publicly confirmed the underlying cause of the incident.
Why am I getting BT password reset codes?
A password reset code normally appears because BT’s recovery process has been triggered for a BT Email account. If you requested the reset, that is expected. If you did not, the request came from somewhere else or was generated as part of the wider issue BT has been investigating.
| What you are seeing | Likely explanation | What to do |
|---|---|---|
| One code after you clicked “Forgotten log-in details?” | EXPECTED | Use the code only in the BT reset process you started yourself. |
| One unexpected code | UNREQUESTED | Do not share or enter it anywhere. Check your account normally rather than following unexpected links or calls. |
| Dozens or hundreds of codes | KNOWN ISSUE | BT has acknowledged repeated unsolicited PIN messages affecting a small number of customers and says mitigations have been introduced. |
| Codes plus suspicious account changes | SECURITY CHECK | Secure the account immediately and inspect forwarding, rules, contacts and recovery details. |
The exact cause remains unconfirmed publicly. Reporting has discussed the possibility of automated password-reset requests, but BT has not said whether the wider incident was caused by malicious requests, a system fault or something else. Do not present any one explanation as confirmed.
What has BT said about the reset-code flood?
BT first acknowledged the problem on its Community forum, saying it was aware that some customers had received large numbers of password-reset PIN messages and that it was investigating the cause.
An updated BT statement reported by The Register on 17 September 2026 said a small number of customers had received repeated reset PINs through text or email. BT said it had implemented measures intended to prevent more repeated reset messages from being sent and was contacting impacted customers directly.
BT’s stated advice for people affected by this particular incident is to ignore the unsolicited PIN messages. It says customers do not need to take further action solely because they received the codes.
If the messages have stopped and nothing else on your account has changed, BT’s current incident advice is to ignore the old unsolicited codes. Never give a reset PIN to somebody who calls, texts or emails you unexpectedly.
Should you change your BT Email password?
For the specific September PIN flood, BT says affected customers do not need to take further action simply because they received the messages. That means there is no need to repeatedly change your password every time another unsolicited code arrives if there is no other sign that the account has been accessed.
However, BT gives different advice when an email account shows signs of actual compromise. If you see mail you did not send, unknown forwarding, unexpected changes to recovery details, or BT blocks the account because it has detected suspicious activity, BT advises securing the account and changing the password.
BT also recommends using a unique password for BT Email rather than reusing a password from another website.
Changing the password may not stop reset codes from arriving. During this incident, customers reported that new reset messages continued after password changes. A password reset request can be triggered before the existing password is known, so password rotation and stopping reset requests are separate issues.
How do I know if my BT Email account is actually compromised?
An unexpected PIN on its own is not proof that somebody has logged into your mailbox. BT’s own security guidance points to other signs that matter more, including unusual messages in your Sent folder and repeated login problems.
BT says that when it detects suspicious activity it may block access to protect the account and ask you to change your password. If that happens, follow the instructions shown when signing in through BT itself.
What should you do if the codes keep arriving?
A genuine one-time PIN should only be used for a reset process you deliberately started. Never read it out to an unexpected caller.
BT says suspicious messages should not be used to access your account. Open BT directly in your browser or use the official app instead.
If you can still sign in normally, inspect Sent mail, rules, forwarding and recovery details rather than assuming the code itself proves a takeover.
If you find suspicious activity, change the BT Email password, use a unique replacement and update the password on every legitimate device and email app.
BT specifically told affected customers to remain vigilant for unusual activity, further messages or unexpected calls.
Could the reset-code message itself be fake?
Yes, phishing messages can imitate BT branding. BT says it will never ask you for your password or bank details, send an unexpected attachment, or ask you to click a link in an email to verify your account on BT.com.
If a message looks suspicious, BT says not to click links or reply. Suspicious emails can be forwarded to phishing@bt.com and then deleted.
Open BT directly
Type the BT address yourself or use the official BT app. If you intentionally need to reset the email password, BT’s help guidance starts from the BT Email login and the “Forgotten log-in details?” option.
Someone asks for the PIN
A person calling or messaging you and asking you to read out a password-reset code should not be trusted. Do not give them the code.
What if BT keeps saying the password is wrong?
This is a different but related BT Email problem. BT says repeated login failures are commonly caused by an old password still being saved on a phone, tablet, Outlook, Apple Mail or another email client.
If you change your BT Email password, update it everywhere the account is configured. Otherwise an old device can keep trying the previous password and trigger account lockouts.
Reset-code flood versus login failures: unsolicited PIN messages do not automatically mean an old device is causing them. But if BT is locking your account after repeated failed logins, check every device and mail client for an outdated saved password.
If BT Email password reset codes are arriving even though you did not request them, do not use or share the codes. BT has confirmed that a small number of customers were hit by repeated unsolicited reset PINs in September 2026 and says mitigations have been put in place. The exact cause has not been publicly confirmed. If the codes are the only unusual thing happening, BT’s incident advice is to ignore them. If you also spot unauthorised mail, forwarding, rules, recovery details or login changes, secure the account immediately.
BT Email reset-code FAQs
Does a BT password reset code mean someone has my password?
Not necessarily. A reset code can be generated when a password-reset process is triggered, and BT has confirmed that some customers recently received repeated unsolicited PIN messages. BT has not publicly confirmed the underlying cause. Treat unexpected codes as a reason to stay alert, but a code on its own does not prove someone knows your current password.
Should I change my BT Email password if I get an unexpected reset code?
BT's current advice for the September 2026 reset-PIN incident is that affected customers do not need to take further action and should ignore the unsolicited PINs. If you also see suspicious account activity, login problems, unknown forwarding rules or messages you did not send, BT advises securing the account and changing the password.
Why do BT password reset codes keep arriving after I change my password?
Changing the password may not stop new reset requests from being generated. During the September 2026 incident, customers reported that changing their password did not stop the messages. BT has since said it implemented mitigations to prevent further repeated reset messages.
Related pages
Sources
- The Register: BT Email users hit by unsolicited password reset PINs — original reporting plus BT’s updated 17 September statement that mitigations had been implemented.
- ISPreview: BT Email users suffer barrage of password reset messages — UK broadband-industry coverage of the reports and BT’s initial response.
- BT Community: moderator response — BT’s acknowledgement that customers were receiving large numbers of reset PINs and its advice to ignore them while the cause was investigated.
- BT Help: Change or reset a BT Email password — official password-reset process and unique-password guidance.
- BT Help: How can I tell if my email account is no longer secure? — official checks for contacts, rules, forwarding, recovery addresses and account security details.
- BT Help: How to spot phishing and spoofing — current guidance on suspicious messages, links and reporting phishing.
- BT Help: Repeat login failures — explains how old passwords saved in email apps and devices can cause repeated login failures and account locks.