Hi I guess my hope from posting this thread is to find out what, if anything, you would do in my circumstances....

I swtiched broadband/phone providers in May 2017.

I realised i would lose my 10 year old email address but was ok with this and went about trying to change all online account details which used the old address before the termination date.

Then largely forgot about the old account.

In December this year my airline loyalty account was hacked.

After speaking to the airline they told me that the hacker had entered in my ID number and then used the forgotten password link to have an email sent to reset it.

Once they reset the password they used all 100K airline miles up, spending them on e-vouchers.

Even though the airline gave me the voucher numbers, an email account for the provider and told me that they hadnt yet been spent

- the voucher company refused to cancel them and just copied and pasted their terms and conditions everytime i contacted them.

The airline said that they had not been hacked

- but my registered email address was the source of the issue.

It was then i realised i had not changed the email address from the old cancelled account on this site.

If ISP had deleted my email address when i left them it wouldnt have been possible.

I did call the ISP and they said very sorry but they're not liable for third party losses and that was after 1 month of consulting their legal team.

do i write this off as a very expensive lesson?

Or should the ISP have deleted the email account when i left?

They dont delete emails when you switch.

My broadband is with BT but I still use as a working email my old aol email address.

I would suspect that your only recourse is with the air miles people but I think all they say I your details are not secure and someone knows your log in

Thread moved to the appropriate forum, please continue to post here to your thread.

Regards

Andy

Hi my broadband account was with BT,

they say they do disable/delete accounts when you leave,

or if you want to keep the accounts you have to pay to keep them live.

They have confirmed that they deleted the email account on the 17th December

- the day i reported the security breach!!

The reason someone knew my login ID was that these details are contained on the monthly statements going to the "closed" email address.

They literally only needed to reset the password!

who was the hacked email with?

edit seen the last post...

so how did they hack the email account?

this smacks of virus infection webmail hacking

not anything to do with deleting things quick enough

have a test here

https://haveibeenpwned.com/

My broadband and email address were with BT. Just got this reply from them.

Your email account remained active with our email supplier following your closure of your BT account in May 2017.

All BT email accounts are deactivated on our system 60 days after the broadband account is closed down if an order isn’t placed for premium mail.

Although your email account had been deactivated within our database which stopped any access via www bt.com / email there was a backlog in the deletions from the server.

Even though your email address was shut within BT’s database as you were no longer a customer, our email supplier still monitored the account for anything suspicious.

The terms for both active and pending delete emails remain the same,

BT and our email suppliers will provide the same duty of care in respect to the security of the accounts.

When suspicious activity is recognised the accounts are locked to stop any access.

I’m sorry that the hacker was able to complete the password reset on the 3rd party service in question before the account was locked.

Whilst your email account which was provided by BT was used to orchestrate a cybercrime,

any liability for any loss incurred would lie with the service where the loss occurred.

This comes under losses which we couldn’t reasonably have expected or which we couldn’t have considered when entering into the agreement when you created the email account.

Hi

I'm not totally tech savvy and the website link you sent was interesting, i never knew it existed.

I guess you dont until you have a problem.

The link you sent and this showed items one in 2013 and one in August 2017.

The 2013 provider sent a mail and i changed my details at that time.

The August 2017 was 4 months after I left BT so if there were any warning emails i wouldnt have got them.

I guess a passowrd change every x weeks is the only way or using something like fingerprint passwords for everything to keep safe in the future?

Still seems unfair, the hacking was 7 months after i left and if they had deleted the account i wouldnt be out of pocket.

Surely this can be reported to the police as theft. You may then be able to get the e-vouchers cancelled.

what about actionfraud?

the airline know who used your vouchers and they know it wasnt you

so it makes me wonder what they are hiding and why they havent taken action themselves.

A claim against BT is 50/50 as they could also argue that they were doing you a favour keeping the old account open and it isnt their doing it was hacked and any consequential loss is not their responsibility.

The last bit has the known problem going against them and the excuse of a backlog isnt really an excuse.

Changing passwords doesnt make them more secure, the opposite is often true as people repeat existing ones or use easy to remember ones that are less secure.