Phishing or legit O2 text message?

[Anonymous]

This morning I recieved this text message perportedly from O2:

"We have reason to believe your email and password for MyO2 has been obtained by third parties through phishing and may be used to access your MyO2 account.

As a precaution, we will suspend your password on MyO2 and send you a new one to enable you to reset it.

For more advice, visit ******(plus some randon letters and numbers I've removed incase it is malicious. Link also edited to remove exact address) or contact us."

I did not follow the link in the text message, instead I went to the 02 site seperatly and logged in with no issues to My O2. No messages came up saying I needed to reset my password and I have not received an email as the text message said I would.

It all looks very dodgy as far as I'm concerned, but frankly its a very convincing text, with none of the usual give aways. Its comes from 'O2UK', has proper English and the address does have o2.co.uk in it although with some before and after extras which I can't find any info on.

Anyone else get this?

[Anonymous]

Hi all, I also got this text message this morning and 10 minutes ago my password got reset by O2 and I was text the new password. The URL redirects users to: http://www.o2.co.uk/help/safety-and-security/fraud-and-phishing-advice#qs

And I don't think the s.o2.co.uk domain is dodgy as a fraudster would not have access to the o2.co.uk domain records to create the sub domain.

I've called O2 after i recieved both text messages and they were unable to help me at all.

Like the original poster I was able to login fine with my original password this morning until it was reset 10 mins ago.

[Anonymous]

If anyone has any information to share on this it would be greatly apprechiated. I'm wondering if a handful of customers have been flagged with this by accident?

[Cleoriff]

This looks pretty serious actually. I think @Martin-O2 and @Toby should be made aware of this again. It's one thing getting the text ...completely different having your password changed?....

[Anonymous]

Yes very serious. The more i look at s.o2.co.uk the more worring it gets! When i visited the URL a lot of cookie information is passed to the website! Also the ssl certificate on the website was issued to davinci-crm.com and not o2.co.uk!!!

Needless to say I've changed my o2 password again!!! Don't go on the site people!!!

For investigation purposes:

08:00AM Recieved text from "O2UK" warning me and advising my password was going to be suspended and I was going to be sent a new one.

After recieving this text i logged into o2.co.uk fine with my existing password and changed it anyway. I called O2 customer support and they had no idea why I recieved the text and my account looked fine, asked to speak to someone in fraud team but was unable to and I'm now waiting for them to call me (up to 5 working days quoted).

13:38 Recieved text from "O2 UK" (note the space inbetween) with new password included in the text.

After recieving this text I tried to login with new password set after the last text which did not work. I then logged in successfully with new password from text message. I've now changed my password twice since. I called O2 to see what was going on again with this but they were not able to help me and didn't understand why I would have had my password set.

[Martin-O2]

Thanks for the mention @Cleoriff ! 

We have requested further information on this issue and hope to have an update shortly. Please keep an eye on this thread for further details. 

[Anonymous]

Thank you @Martin-O2, I've updated my last post with more detailed information and timeline.

[Martin-O2]

Great @Anonymous the more detail for these things the better. Much appreciated.  

[MI5]

Hopefully this is being treated with some priority?

[Anonymous · Accepted solution]

Before I posted the first post here, I also sent the text message to phishing@o2.com.

I have now recieved an email in reply to that report. O2 are saying this text message is a legitemate text from O2 and is NOT a scam.

I immediatly logged in to My O2 and changed my password. Then 20 minutes later I get another text from O2 sending me a new autogenerated password which I should now login using and then I can set yet another new password. Seems this is the password reset procedure they should have sent when they sent the text message this morning.

This is a right mess, if the first instance of the text sent at 08:02 this morning is now confirmed as a legit O2 message and therefore s.o2.co.uk is a legit address, then don't you think this could have been handled a lot better?

Thanks Toby and others for doing what you can on here though, much apreciated but still pretty worrying.

[Perkin]

Ditto to this. I've just been through the same rigmarole - I reset my password when I got the first message (not via the in-text link though). Then 4 hours later got a reset code and was locked out of my account. I've since spoken to the O2 Fraud Team who confirmed the text messages are genuine.

If you're not comfortable using the code in the text, simply go online and use the 'forgot my password' link on the log-in page.

Apparently notices went out to O2 Customer Services last week to give them the heads up for this, but that doesn't seem to have worked as neither of the 2 live chat agents I had exchanges with today knew anything about this.