Password recovery email sent to wrong address

[gmlack]

I've just been locked out of 2 of my TalkTalk email accounts (the other 2 remain OK) - password invalid.
Both locks occurred at the same time (23:34 OK, 23:48 failed - Sunday).

So I connected to the TalkTalk Web mail page and clicked on the "Forgot you password?" link.
This says it will send a rest link to my phone and to the configured recovery email address.

The SMS messages arrived OK, and worked, so I have email access again.

However, the email was not sent to my recovery address but was actually sent to the TalkTalk address that was failing (so I couldn't access it there!).

And yes, I have checked that I have the correct recovery email set-up for both accounts.

I've given up on ever being given an explanation for why some of my email accounts "lose" their passwords every 6 months or so.

But it would be useful if someone could look into why the recovery link is not being sent to the configured recovery address.

[Gliwmaeden2]

Thanks, @mandisa1-TT.

The OP has now confirmed that they found the link in the correct alternative address eventually, but in SPAM. 

At least it arrived, but people need to remember that notifications from Talktalk are often treated as spam by the receiving address.

So all that remains is the not very clear instructions about and /or etc.

😊

[mandisa1-TT]

Hi there @gmlack, I actually agree with @Gliwmaeden2 
 

In this case you might have selected SMS as your recovery method and the duplicate is being sent to your affected email address as an affirmation. 

Thank you for testing @nameunknown_ 

This has been escalated and will be investigated.

[Gliwmaeden2]

This is why I have asked staff to check the wording, @nameunknown_.

It should not have a discrepancy between or and and anywhere at all on different pages and at different stages of the process. 

I'll lock the thread so we don't get more embroiled in this before staff can reach the topic.

[nameunknown_]

@Gliwmaeden2 

There is no option to choose. After selecting to receive a password reset message, the response message is:

"We will send a password reset link to the mobile phone number and the alternate email address you provided."

Perhaps, @gmlack also received a password reset email in the spam folder of the alternative email account, but only looked in the Inbox, and not the spam folder.

[gmlack]

A password reset message was sent to the alternative (recovery) email address, and to the email address of the account for which the password reset was requested.

I did not receive any messages to the recovery email address.

But what happens if you choose SMS?

There is no choice at the point where you request the link.

[Gliwmaeden2]

Thanks, @nameunknown_.

But what happens if you choose SMS?

If you don't use a mobile, it looks like this is working correctly. 

@gmlack, I think the duplicate to the affected email address is just an affirmation that it was for this account and your primary communication was via SMS.

I have flagged it up behind the scenes but we won't hear back from the manager today. 

[nameunknown_]

@gmlack , @Gliwmaeden2 ,

I have just tested this. A password reset message was sent to the alternative (recovery) email address, and to the email address of the account for which the password reset was requested. In my case, both emails arrived in the spam folder.

[Gliwmaeden2]

I'll flag it up for attention as at least the wording should match everywhere, @gmlack ....!

[gmlack]

However, if you follow the "Forgot your password?" link the text there says:

We will send a password reset link to the mobile phone number and the alternate email address you provided.

There is no selection, and the link is sent twice. Just that it doesn't go to the alternate email address, but rather the one whose password you are trying to reset. Which strikes me as the height of futility.

I also now have a feeling I've reported this before (so probably the last time some of my passwords went AWOL for no given reason).

[Gliwmaeden2]

It looks from their instructions as though you are sent it by a text OR email, so perhaps it's arriving in the affected email address simply as a copy of the SMS link?

I can't test it as I don't want to fiddle with my own settings, but both bits of text here give the impression that you would expect to receive it just in one medium, not both. So not the alternative email address if you have chosen SMS, @gmlack.

Sometimes firms send a confirmation email to the affected address to make sure it's you. 

Text here definitely says OR:

 So "select either of these alternative contacts".....