On this webpage, the BBC says:

I’ve received a ‘Changes to your BBC account’ email claiming to be from the BBC – is this a genuine email?

At the end of September 2016, we upgraded our ‘BBC iD’ sign-in system to ‘BBC Account’, and as a result we had to sign everyone out of their ‘BBC iD’ account.

If an email address was previously registered against a ‘BBC iD’ account, we’ve been sending emails to these email addresses (from ‘[email protected]’) advising users that we’ve signed them out of their account and asking them to sign back in.

These are genuine emails from the BBC and not phishing emails or spam (below is a screenshot of the email content).

… and that's it.

I discovered this on a Facebook comment thread, where the above webpage was given as "proof" that an unexpected email was genuine and not a phish.

The email contains a link to "sign in" — this link will require users to input their credentials, by definition (due to the reason for sending the email in the first place).

Isn't all of this incredibly irresponsible? Isn't the BBC grossly mistraining its audience? The From field of an email has never been anywhere close to proof of the sender's identity, and providing a screenshot of the genuine content just makes it easier for fraudsters to reproduce it and con people.

Or am I missing something?

  • 28
    How can we be sure that that page is legitimate? ;) On the other hand, BBC already redirects away from HTTPS, so they're not exactly security savvy.
    – Rhymoid
    Nov 12, 2016 at 23:11
  • 14
    @Rhymoid It really does not use HTTPS. Incredible in this day and age.
    – user120539
    Nov 12, 2016 at 23:17
  • 4
    @Rhymoid however, I did decide to contact them - with this: i.sstatic.net/x8Aur.png
    – Tim
    Nov 13, 2016 at 17:43
  • 5
    @Tim For a second, I thought you wew going to contact them with this, because this all seems very backwards to me.
    – Rhymoid
    Nov 13, 2016 at 17:59
  • 6
    What I want to know is why they didn't just log people out and assume people will figure it out themselves later...?
    – user64742
    Nov 14, 2016 at 16:28

1 Answer 1


Very dangerous things could happen here, indeed. It would be laughably easy for a scammer to phish users.

A migration is an excuse many phishers already use:

There was xyz problem in our user database [...] just "log in" or you won't be able to use our service.

So the legitimate reason

we upgraded our ‘BBC iD’ sign-in system to ‘BBC Account’

aligns quite perfectly with these nefarious activities. Spammers could even put a "proof" with the website link. Users see that the email layout is the same, think oh, this is legit, click sign-in and send the credentials to the attackers.

Having access to a BBC account isn't much of a threat, as far as I know. However, for those users who have the same password in all sites (and no two-step verification), then you've got an easy way to access email, bank accounts, and the like.

The BBC dropped the ball hard. I'll be contacting them to fix the issue, I encourage you to do the same thing.

  • 65
    It may be true that the BBC Account may not have much of value worth protecting. Even so the real damage here is perpetuating the idea that emails like this are ever legit. In addition there is nothing here that couldn't be communicated more effectively and timely when users visit the site. Which leaves me feeling like this email is mostly meant to remind you to visit the site. It's actually genuine spam. Nov 12, 2016 at 21:44
  • 22
    @CandiedOrange Enough people re-use passwords that the password itself is probably orders of magnitude more valuable than the BBC Account. Nov 13, 2016 at 14:43
  • 3
    Also: "please re-register, giving us your postcode, as despite numerous claims of Culture-level technology being created to find out if you have a TV License when using iPlayer, in fact the only real way is to try to match your BBC Account postcode to a registered License postcode." Nov 14, 2016 at 12:11
  • 2
    Whenever I see an email like that that I confirm is fake, I don't send my credentials. I type in as many fake credentials as I can think of. Sometimes I even type in as a password "Did you really think that would work?".
    – user64742
    Nov 14, 2016 at 22:17
  • 4
    @TheGreatDuck: With that, you're potentially just letting them know that your email address is valid and connects to a person... which, a lot of the time, is all they wanted to know in the first place. Don't engage at all. Feb 16, 2018 at 1:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .