<http://schema.org/articleBody>
"Oh dear. It seems that BT has a bit of security hole on its hands. One where people can order different features for your phone line and yes, you would be paying for that until you can undo it.\r\n\r\nThe Register\u00A0reported a privacy bug that was highlighted by one of its readers. Part of the problem was solved but a larger issue has yet to be addressed (we checked).\r\n\r\nThe initial problem was that phone and calling upgrades can be added with the use of a postcode and telephone number on the packages pages of the BT website. According to the Register, initially logging in this way revealed customers' full name and account details.\r\n\r\nThis has now been fixed, but it appears you can still add packages with only those two details to log in.\r\n\r\n\r\n\r\nYou'll note the little tick-box on the page there, &amp;quot;I confirm I am the account holder&amp;quot; - doesn't really stop much if someone really wants to mess with your accounts. That should be adhered to like minors honestly admitting they are under aged for streaming adult content on the Web, said nobody, ever.\r\n\r\nAs you can see from the image below. Once you are in, you can see the type of calling plan you have and then choose from a bunch of upgrades.\r\n\r\n\r\n\r\nBT gave the Register a statement amounting to the idea that different levels of security apply to different products.\r\n\r\nWe gave them a call too and spokesperson told us the following:\r\nIt\u2019s only low-level things and it\u2019s there for the convenience of the customer. You can\u2019t divert calls or anything that would cause major problems. It a matter of security and convenience to be in balance.\r\nThey also said that if this were to happen to a customer, they would get \u00A0an email notification about the order which would alert them and they can call up and say &amp;quot;I didn't order this&amp;quot; and have it changed back. Which doesn't really sound like security or convenience.\r\n\r\nMore to the point, BT did not say that they would be changing this as that balance would be more convenient for customers. We're guessing that customers will decide in the long run how convenient they think this will be if their accounts are updated without their permission.\r\n\r\nImage Credit: Joe Raedle / Getty Images"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/uk/2012/11/27/bt-log-in-page-lets-others-add-services-to-your-payment-plan/>